On this page
CWE-264: Permissions, Privileges, and Access Controls
Weakness Summary
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- Canonical source: MITRE CWE-264 (opens in a new tab)
- Published Atomicorp CVE observations: 31
- Distinct affected products in those observations: 27
- Active Atomicorp rules associated with this weakness: 46
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-1999-1011 | MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution | data access components | Protected by Atomicorp rules | 310710 , 334168 , 340145 , 340156 , 341145 , 341245 , 390724 , 391213 , 392647 |
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801 |
| CVE-2012-0297 | Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability | web gateway | Protected by Atomicorp rules | 340007 , 344360 |
| CVE-2012-0299 | Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability | web gateway | Protected by Atomicorp rules | 390700 |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | firewall security manager | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 380018 , 390801 |
| CVE-2016-9269 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | Protected by Atomicorp rules | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2015-4683 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | Protected by Atomicorp rules | 330791 , 340152 , 392301 |
| CVE-2015-6018 | ZYXEL PMG5318-B20A - OS Command Injection | pmg5318-b20a firmware | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 391213 |
| CVE-2015-3628 | F5 iControl iCall::Script Root Command Execution | big-iq security | Protected by Atomicorp rules | 344363 |
| CVE-2015-7766 | ManageEngine OpManager Remote Code Execution | manageengine opmanager | Protected by Atomicorp rules | 340145 , 340156 , 341245 , 344370 |
| CVE-2013-3632 | OpenMediaVault rpc.php Authenticated Cron Remote Code Execution | openmediavault | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2016-9315 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | Protected by Atomicorp rules | 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 399526 |
| CVE-2014-2849 | Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution | web appliance firmware | Protected by Atomicorp rules | 344361 , 344363 |
| CVE-2015-1489 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 , 392301 |
| CVE-2016-1337 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | Protected by Atomicorp rules | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2020-12028 | Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution | factorytalk view | Protected by Atomicorp rules | 390716 |
| CVE-2007-1036 | JBoss JMX Console Deployer Upload and Execute | jboss application server | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390801 , 392648 |
| CVE-2013-6129 | vBulletin Administrator Account Creation | vbulletin | Protected by Atomicorp rules | 331358 |
| CVE-2014-0112 | Apache Struts ClassLoader Manipulation Remote Code Execution | struts | Protected by Atomicorp rules | 392648 |
| CVE-2014-9735 | WordPress RevSlider File Upload and Execute Vulnerability | showbiz pro | Protected by Atomicorp rules | 330791 , 337469 , 340152 |
| CVE-2019-1621 | Cisco Data Center Network Manager Unauthenticated File Download | data center network manager | Protected by Atomicorp rules | 344360 , 390709 |
| CVE-2015-4027 | Acunetix WVS 10 - Local Privilege Escalation | web vulnerability scanner | Protected by Atomicorp rules | 330791 , 340152 , 390726 , 392647 |
| CVE-2010-3714 | TYPO3 sa-2010-020 Remote File Disclosure | typo3 | Protected by Atomicorp rules | 344360 , 390613 , 390614 |
| CVE-2015-4685 | Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities | realpresence resource manager | Protected by Atomicorp rules | 330791 , 340152 , 392301 |
| CVE-2008-3273 | JBoss Vulnerability Scanner | enterprise application platform | Protected by Atomicorp rules | 330925 |
| CVE-2010-1429 | JBoss Vulnerability Scanner | jboss enterprise application platform | Protected by Atomicorp rules | 330925 , 382240 |
| CVE-2014-2268 | Vtiger Install Unauthenticated Remote Command Execution | vtiger crm | Protected by Atomicorp rules | 341245 , 344370 , 360152 , 380026 |
| CVE-2013-3617 | Openbravo ERP XXE Arbitrary File Read | openbravo erp | Protected by Atomicorp rules | 330791 , 340152 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 310710 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 330925 | Active | disruptive (deny) |
| 331358 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337469 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340133 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340149 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 341145 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 380018 | Active | disruptive (deny) |
| 380026 | Active | disruptive (deny) |
| 382240 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390613 | Active | disruptive (deny) |
| 390614 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390724 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 399526 | Active | disruptive (deny) |