CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- ntp, canonical ubuntu linux, freebsd +4 more +6 moreNTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the...6.5 Medium
- cisco firesight system softwareCisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection...5.0 Medium
- ntop ntopngntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and...6.0 Medium
- xenXen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1)...7.2 High
- apple mac os xThe System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts,...7.6 High
- google androidBluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to...4.3 Medium
- openstack ironic inspectorInjection vulnerability that affects ironic-discoverd6.8 Medium
- csl dualcom gprs cs2300-r firmwareCSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to...4.3 Medium
- blackberry enterprise serverThe Management Console in BlackBerry Enterprise Server (BES) 12 before 12.2 does not properly...4.3 Medium
- xenThe hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows...4.9 Medium
- apple remote desktop, mac os x +1 moreThe Remote Desktop full-screen feature in Apple OS X before 10.9 and Apple Remote Desktop before...3.7 Low
- microsoft windows 10, windows 7, windows 8 +6 more +8 moreThe kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...2.1 Low
- mozilla firefoxMozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon...4.3 Medium
- hp arcsight loggerHP ArcSight Logger before 6.0 P2 does not limit attempts to authenticate to the SOAP interface,...5.0 Medium
- mozilla firefoxMozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross...7.5 High
- mozilla firefoxMozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the...7.5 High
- mozilla firefoxThe Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting,...4.3 Medium
- openstack novaOpenStack Compute (Nova) allows remote attackers to bypass intended restriction5.0 Medium
- janitza umg 508, umg 509, umg 511 +2 more +4 moreJanitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes...5.0 Medium
- janitza umg 508, umg 509, umg 511 +2 more +4 moreThe web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN...10.0 High
- phpmyadminphpMyAdmin allows remote attackers to spoof content via the url parameter5.0 Medium
- redhat jboss enterprise application platform, jboss wildfly application server +1 moreThe Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly ...4.3 Medium
- afnetworking project afnetworkingThe default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the...4.3 Medium
- apple mac os xSecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching...4.3 Medium
- apple iphone osThe OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows...5.0 Medium
- apple iphone os, watchos +1 moreThe X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the...4.3 Medium
- accelerite radia client automationThe default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client...5.0 Medium
- fedoraproject 389 directory server389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the...7.5 High
- redhat enterprise linux, enterprise mrg, kernel-rt +3 more +5 moreThe Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when...5.5 Medium
- google chromeThe CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading...7.5 High
- microsoft windows 10, windows 8, windows 8.1 +6 more +8 moreThe kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold...7.2 High
- apple mac os xThe protected range register in the EFI component in Apple OS X before 10.11 has an incorrect...7.1 High
- apple mac os xThe Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked...7.2 High
- gnu glibcThe process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23...5.5 Medium
- mozilla firefoxMozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar...4.3 Medium
- moodleMoodle uses predictable password-recovery tokens7.5 High
- mozilla firefoxMozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass...6.4 Medium
- mozilla firefoxMozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API...9.3 High
- mozilla firefoxMozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the...2.6 Low
- mozilla firefoxjs/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain receiver arguments,...4.3 Medium
- apple iphone osSafari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and...5.0 Medium
- apple iphone osSafari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and...4.3 Medium
- apple iphone osMail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e...5.0 Medium
- apple iphone osThe Application Store component in Apple iOS before 9 allows remote attackers to cause a denial...4.3 Medium
- apple iphone osAppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of...2.1 Low
- apple iphone os, mac os x, watchos +2 moredyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an...5.0 Medium
- microsoft windows 10, windows 8.1, windows rt 8.1 +1 more +3 moreThe kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10...2.1 Low
- google chromeGoogle Chrome before 45.0.2454.85 does not display a location bar for a hosted app's window after...4.3 Medium
- google chromeThe decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in...6.8 Medium
- google chromeThe RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime...4.3 Medium
- Show moreLoading…