An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in
An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access t
A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the
An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw
A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Re
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacke
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacke
A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a conta
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat
Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the q
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation c
A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc s
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 cont
Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is give
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin us
Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2
It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3,
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maist
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An a
A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an i
A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification v
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecti
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting
An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global
Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote
A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an aut
A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to g
A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Con
A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster vol
A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it in
It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform befor
Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows fo
An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-i
Frequently Asked Questions
What is CWE-266?
CWE-266 (CWE-266) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.
How many CVEs are classified as CWE-266?
There are 1,098 CVE records associated with CWE-266 in our database. Of these, 122 are critical severity, 343 are high severity, and 567 are medium severity.
How can I protect against CWE-266 vulnerabilities?
Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-266 using AI-powered security agents.
Detect CWE-266 Vulnerabilities
CyberStrike's AI agents automatically detect cwe-266 vulnerabilities across your infrastructure.
Get Started