CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- devise-two-factor Improper one time password handling in devise-two-factor 5.3 Medium
- huawei emui, harmonyos +1 more The fingerprint module has a security risk of brute force cracking. Successful exploitation of... 4.6 Medium
- lexmark 6500e firmware, c734 firmware, c736 firmware +68 more +70 more The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices. 5.3 Medium
- soflyy wp all import The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests... 7.5 High
- getawesomesupport awesome support The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes... 7.5 High
- networkgenomics mitogen Undirectional routing wasn't respected in some cases in Mitogen 9.8 Critical
- xtrlock project xtrlock, debian linux +1 more xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked... 4.6 Medium
- cpanel cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang... 3.3 Low
- cpanel cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls ... 6.5 Medium
- cpanel In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC... 6.5 Medium
- cpanel Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). 7.5 High
- cpanel cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC... 4.3 Medium
- cpanel cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC... 7.5 High
- cpanel cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). 4.3 Medium
- cpanel In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account... 3.3 Low
- amcrest ipm-721s firmware Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in... 9.8 Critical
- blipcare wi-fi blood pressure monitor firmware In the most recent firmware for Blipcare, the device provides an open Wireless network called ... 7.1 High
- starry s00111 firmware The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup... 8.0 High
- netapp oncommand unified manager, oncommand unified manager for vmware vsphere,linux and windows 7.2 and above +1 more OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without... 7.5 High
- z.cash zcash Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent... 7.5 High
- ubuntu maas, canonical metal as a service +1 more uuid.uuid1() is not suitable as an unguessable identifier/token 2.0 Low
- redhat libvirt, debian linux +1 more libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with... 7.5 High
- k-9 mail project mail K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking,... 4.3 Medium
- tommy hilfiger th24/7 android app, hp tommy hilfiger th24\/7 +1 more A potential security vulnerability caused by incomplete obfuscation of application configuration... 2.1 Low
- hp isaac mizrahi smartwatch, isaac mizrahi smartwatch mobile app +1 more A potential security vulnerability caused by the use of insecure (http) transactions during login... 7.5 High
- apple iphone os In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed... 5.9 Medium
- apple tv, iphone os, mac os +2 more In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update... 5.9 Medium
- facebook osquery An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third... 7.8 High
- phpmyfaq phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by... 5.3 Medium
- mozilla firefox When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit... 7.5 High
- cisco web security appliance A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow... 7.5 High
- infragistics igniteui, hackerone igniteui node module +1 more Resources Downloaded over Insecure Protocol in igniteui 7.4 High
- hackerone hapi node module, hapijs hapi +1 more Unsafe Merging of CORS Configuration Conflict in hapi 5.9 Medium
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9635m firmware +27 more +29 more In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile,... 6.8 Medium
- qualcomm, inc. snapdragon mobile, qualcomm mdm9625 firmware, sd 800 firmware +2 more In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile... 7.5 High
- sophos endpoint protection Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection... 5.5 Medium
- malwarebytes anti-malware A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware... 7.8 High
- ibm financial transaction manager IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x... 5.4 Medium
- carbonblack carbon black A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor... 9.8 Critical
- ibm websphere application server The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM... 9.8 Critical
- mod gnutls project gnutls mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a... 7.5 High
- dpdk, linux kernel ixgbe, intel 82576 firmware +5 more +7 more On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control... 8.6 High
- cisco webex meetings server A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to... 8.1 High
- ibm security identity manager virtual appliance IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS... 9.8 Critical
- freenas FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root... 9.8 Critical
- opendaylight karaf Password change doesn't result in Karaf clearing cache 7.5 High
- cisco asyncos, email security appliance +1 more A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS... 5.8 Medium
- seagate st500lt015 firmware Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541... 4.2 Medium
- samsung 850 pro firmware, pm851 firmware, seagate st500lt015 firmware +1 more +3 more Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk... 4.2 Medium
- samsung 850 pro firmware, pm851 firmware, seagate st500lt015 firmware +1 more +3 more Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk... 4.2 Medium
- Show olderLoading…