Weakness (CWE)
CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Source: MITRE CWE-264
309 results · Feed
-
High 7.8
Cisco NX-OS Software Bash Shell Role-Based Access Control Bypass Privilege Escalation Vulnerability
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by executing commands authorized to other user roles. The attacker must authenticate with valid user crede…
-
High 7.8
Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Shell Escape Vulnerability
A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escape a restricted shell on an affected device. The vulnerability is due to insufficient sanitization…
-
High 7.4
Cisco NX-OS Software 802.1X Extensible Authentication Protocol over LAN Denial of Service Vulnerability
A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible A…
-
High 7.8CVE-2019-3475 Public exploit
Local privilege escalation in Filr famtd
A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
-
High 7.8
Cisco SD-WAN Solution Privilege Escalation Vulnerability
A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included…
-
High 7.8
Privilege Escalation Vulnerability in Cisco SD-WAN Solution
A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerability exists because user input is not properly sanitized for certain commands…
-
Unscored —
A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERI…
-
Unscored —
A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERI…
-
Unscored —
Cisco Meraki Local Status Page Privilege Escalation Vulnerability
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local st…
-
High 7.5
Cisco Wireless LAN Controller Software GUI Privilege Escalation Vulnerability
A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain operations within the GUI that are not normally available to that user on the CLI. The vulnerability is …
-
Unscored —
A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privilege…
-
Unscored —
A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp …
-
Unscored —
Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability
A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on …
-
Unscored —CVE-2018-0437 Public exploit
Cisco Umbrella Enterprise Roaming Client and Enterprise Roaming Module Privilege Escalation Vulnerability
A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vul…
-
Unscored —
Cisco Network Services Orchestrator Network Plug and Play Information Disclosure Vulnerability
A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to gain unauthorized access to configuration data that is stored on an affected NSO system. The vu…
-
Unscored —
Cisco SD-WAN Solution Privilege Escalation Vulnerability
A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included…
-
Unscored —
Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability
A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input va…
-
Unscored —
Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability
A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vu…
-
Unscored —
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote …
-
Unscored —
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote …
-
Unscored —
A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attac…
-
Unscored —
A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco…
-
Unscored —
A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated…
-
Unscored —
A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could a…
-
Unscored —
A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticate…
-
Unscored —
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remo…
-
Unscored —
A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenti…
-
Medium 6.8
Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe el…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access …
-
Unscored —
Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gai…
-
Unscored —
A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access …
-
Unscored —
Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gai…
-
Unscored —
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote …
-
Unscored —
Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an…
-
Unscored —
Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could …
-
Unscored —
A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. P…
-
Unscored —
A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authentic…
-
Unscored —
A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Soft…
-
Unscored —
A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Securi…