CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeThe WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in...7.5 High
- google chromeThe UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before...5.0 Medium
- google chromeThe FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader...5.0 Medium
- basware bankingBasware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client...5.8 Medium
- mozilla firefoxThe add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2...7.5 High
- aegirproject hostmasterThe Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal...7.5 High
- apple iphone osWebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site...5.0 Medium
- apple iphone osThe Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within...2.1 Low
- apple safari, iphone os +1 moreWebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS...4.3 Medium
- apple safari, iphone os +1 moreWebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS...5.0 Medium
- apple safari, iphone os +1 moreWebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS...6.4 Medium
- apple safariApple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1...4.3 Medium
- google chrome, debian linux, opensuse +4 more +6 morecontent/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not...4.3 Medium
- google chrome, debian linux, opensuse +3 more +5 moreGoogle Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous...6.8 Medium
- google chrome, debian linux, opensuse +4 more +6 morecore/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not...4.3 Medium
- eaton proview, eaton’s cooper power systems idea/ideaplus relays, series form 6 +2 moreEaton’s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet7.6
- sap afariaThe Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone:...7.2 High
- microsoft windows 8, windows 8.1, windows server 2008 +1 more +3 moreHyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows...7.2 High
- openssl, oracle jd edwards enterpriseone tools, opus 10g ethernet switch family +1 more +3 moreThe X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1...6.5 Medium
- shibboleth identity provider, opensaml java +1 moreImproper Certificate Validation in Shibboleth Identity Provider and OpenSAML4.3 Medium
- apple iphone osThe WiFi Connectivity feature in Apple iOS before 8.4 allows remote Wi-Fi access points to...4.8 Medium
- apple iphone osApplication Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs, which...4.3 Medium
- apple mac os xThe code-signing implementation in Apple OS X before 10.10.4 does not properly consider libraries...6.8 Medium
- apple mac os xApple OS X before 10.10.4 does not properly consider custom resource rules during app signature...5.0 Medium
- apple iphone os, mac os x +1 moreMail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh...4.3 Medium
- apple mac os xApple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not...9.3 High
- apple safari, iphone os, mac os x +2 moreThe Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x...6.8 Medium
- ibm leadsIBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0...3.5 Low
- google chromeThe DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before...4.3 Medium
- google chromebindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not...5.0 Medium
- google chromeBlink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation...5.0 Medium
- google chromecontent/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130...5.0 Medium
- ruby-lang ruby, rubygems, oracle solaris +1 more +3 moreRubyGems vulnerable to DNS hijack attack5.0 Medium
- swiftkey sdkThe SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6...2.9 Low
- cupsThe add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free...10.0 High
- cisco secure access control serverThe REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a...5.0 Medium
- microsoft windows 8, windows 8.1, windows rt +2 more +4 moreThe kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT...4.6 Medium
- hp support solution frameworkHP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary...6.8 Medium
- apple os x, mac os x +1 moreThe XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to...7.8 High
- siemens simatic step 7Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle...6.8 Medium
- inductiveautomation ignitionInductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force...4.0 Medium
- inductiveautomation ignitionInductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which...6.4 Medium
- microsoft windows 7, windows 8, windows 8.1 +4 more +6 moreThe Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1...2.1 Low
- microsoft windows server 2008, windows server 2012, windows 2003 server +2 moreThe NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1,...4.3 Medium
- pivotal software spring frameworkModerate severity vulnerability that affects org.springframework:spring-core5.0 Medium
- mozilla firefox, canonical ubuntu linux, opensuse +2 moreMozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and...5.0 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003...3.3 Low
- cisco unified computing systemThe web interface in Cisco Integrated Management Controller in Cisco Unified Computing System ...4.3 Medium
- pexip infinityPexip Infinity before 8 uses the same SSH host keys across different customers' installations,...7.1 High
- apache santuario xml security for javaImproper Input Validation in Apache Santuario XML Security5.0 Medium
- Show moreLoading…