CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- attic project atticattic has improper verification of unencrypted backups6.5 Medium
- thalesesecurity nshield connect firmwareThales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72...6.8 Medium
- google android, qualcomm, inc. all qualcomm products +1 moreIn a sound driver in Android for MSM, Firefox OS for MSM, QRD Android, some variables are from...7.0 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or...7.8 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD...7.8 High
- google android, qualcomm, inc. all qualcomm products +1 moreWhen a control related to codec is issued from userspace in all Qualcomm products with Android...7.0 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn a display driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD...8.8 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD...7.0 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn a sound driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD...7.0 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel...7.0 High
- elasticsearchImproper Access Control in Elasticsearch7.5 High
- tcoffee t-coffeet-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally.5.5 Medium
- chaos tool suite project ctoolsctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit"...7.5 High
- kubernetes, redhat openshift +1 moreKubernetes in OpenShift3 Access Control Misconfiguration3.1 Low
- grml grml-debootstrapcmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is...7.5 High
- snapcreek duplicatorThe Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and...8.2 High
- abb vsn300 firmware, vsn300 for react firmware +1 moreA Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger...6.5 Medium
- zohocorp manageengine desktop centralManage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of...9.8 Critical
- gigaccsecure gigacc officeGigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user...6.5 Medium
- google androidAndroid 6.0 has an authentication bypass for attackers with root and physical access....6.2 Medium
- cisco elastic services controllerA vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an...9.8 Critical
- netapp altavaultNetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive...8.1 High
- redhat gluster storageRed Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute...7.8 High
- kamailioThe kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges.7.8 High
- gentoo portageEbuild in Gentoo may change directory and file permissions depending on the order of installed...7.1 High
- ibm qradar security information and event manager, security qradar siem +1 moreIBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by...5.9 Medium
- fortinet forticlientIn FortiClientWindows 5.4.1 and 5.4.2, an attacker may escalate privilege via a...8.8 High
- elastic kibana, x-pack security +1 moreWith X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests...6.5 Medium
- google android, qualcomm, inc. all qualcomm products +1 moreIn all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than...7.8 High
- ibm maximo asset managementIBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute...8.8 High
- lenovo mouse suiteLenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator...7.8 High
- japan pension service device data encryption program, specification check program, todokesho creation program +5 more +7 moreUntrusted search path vulnerability in Installers for Specification check program (social...7.8 High
- redhat cloudformsManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.8.8 High
- cisco prime data center network managerA vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an...9.8 Critical
- cisco anyconnect secure mobility clientA vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for...7.8 High
- ibm security access manager, security access manager 9.0 firmware +1 moreIBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some...4.3 Medium
- lenovo service bridgeIn Lenovo Service Bridge before version 4, a user with local privileges on a system could execute...7.8 High
- pivotal spring framework, spring security, spring security +2 moreSpring Security and Spring Framework may not recognize certain paths that should be protected7.5 High
- cloudfoundry cloud foundry, pivotal bosh stemcell +1 moreAn endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6...9.0 Critical
- cloudfoundry cloud foundry, pivotal software cloud foundry uaa, login-server +2 more +4 moreCloud Foundry UAA reset password vulnerable to brute force attack8.1 High
- lenovo solution centerThe backend service process in Lenovo Solution Center (aka LSC) before 3.3.0002 allows local...7.8 High
- huawei p7-l00 firmware, p7-l05 firmware, p7-l09 firmware +2 moreThe GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7...7.8 High
- powerplay gallery project galleryupload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create...7.5 High
- alienvault open source security information managementThe sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local...6.7 Medium
- ibm distributed marketing, marketing platform, marketing operations +2 moreIBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an...8.8 High
- cisco prime collaboration provisioningA vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to...6.5 Medium
- cisco prime collaboration provisioningA vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to...6.5 Medium
- cisco policy suiteA vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS)...7.8 High
- cisco prime collaboration provisioningA vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an...9.8 Critical
- eir d1000 modem firmwareThe Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers...9.8 Critical
- Show moreLoading…