CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- cisco prime infrastructureA vulnerability in the role-based access control (RBAC) functionality of Cisco Prime...5.9 Medium
- cisco asyncosA vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance ...7.8 High
- cisco nx-osA vulnerability in the network-operator user role implementation for Cisco NX-OS System Software...7.1 High
- cisco policy suiteA vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS)...7.5 High
- ibm security identity manager virtual applianceIBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS...7.8 High
- microsemi s350i firmwareSymmetricom s350i 2.70.15 allows remote authenticated users to gain privileges via vectors...8.8 High
- redhat cloudforms management engineThe check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as...8.8 High
- arubanetworks clearpassAruba Networks ClearPass Policy Manager 6.1.x, 6.2.x before 6.2.5.61640 and 6.3.x before 6.3.0...7.1 High
- gitlabThe groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to...6.5 Medium
- zohocorp desktop centralThe DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build...9.8 Critical
- cisco webex meetings serverA vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to...5.3 Medium
- cisco nx-osA vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an...5.7 Medium
- cisco nx-osA vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could...6.8 Medium
- cactiauth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication...8.8 High
- apache openofficeThe Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice...7.8 High
- cisco identity services engine, identity services engine express, identity services engine virtual appliance +2 moreA vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is...7.8 High
- apache cordova, cordova in-app-browser +1 moreThe CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache...9.8 Critical
- cumulusnetworks cumulus linuxThe Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows...7.8 High
- cisco cloud services platform 2100A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an...9.9 Critical
- arubanetworks clearpass policy managerAruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote...9.8 Critical
- fedoraproject spin-kickstartsfedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle...5.9 Medium
- ovirt, redhat ovirt-engine +1 moreoVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin,...7.5 High
- freebsdThe sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain...7.8 High
- wpeasycart wp easycartThe ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin...8.8 High
- tug texliveThe pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and...4.7 Medium
- cisco anyconnect secure mobility clientA vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client...6.5 Medium
- cisco meeting appA vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow...4.2 Medium
- ciphershed, idrix veracrypt, truecrypt +2 moreThe (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7...7.8 High
- ciphershed, idrix veracrypt, truecrypt +2 moreThe IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15,...7.8 High
- lenovo fingerprint managerServices and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows...6.7 Medium
- cisco ios xeA vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation...6.8 Medium
- cisco ios xeA vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an...8.8 High
- cisco ios xeA vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760...8.8 High
- usb-creator project usb-creatorusb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14...7.8 High
- google androiddrivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote...7.0 High
- fso-frameworkd project fso-frameworkd, fso-gsmd project fso-gsmd, fso-usaged project fso-usaged +1 more +3 moreThe D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso...7.8 High
- kupu project kupu, plone +1 moreKupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7...6.8 Medium
- cisco unified customer voice portalA vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP)...8.8 High
- ibm security siteprotector systemIBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.7.0 High
- polycom realpresence resource managerPolycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the...7.0 High
- polycom realpresence resource managerPolycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive...9.8 Critical
- netsweeperNetsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to...5.3 Medium
- symantec malware analysis appliance, malware analyzer g2 +1 moreBlue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote...9.3 Critical
- huawei e5756s firmwareHuawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration...9.8 Critical
- ossecsyscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute...7.0 High
- kamailioThe kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp...7.8 High
- mapsplugin googlemapsThe Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended...7.5 High
- hcl sametimeIBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the...4.3 Medium
- barracuda load balancerPrivilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an...9.8 Critical
- fortinet fortimanager firmwareFortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges...7.8 High
- Show moreLoading…