CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- samba, canonical ubuntu linux +1 moreThe NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4...6.3 Medium
- samba, canonical ubuntu linux +1 moreThe NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8,...5.9 Medium
- puppet enterprisePuppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist...8.8 High
- openstack tripleo heat templatesOpenStack TripleO Heat templates spoof metadata requests7.5 High
- huawei e3276s firmwareHuawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in...6.4 Medium
- postgresqlPostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached...7.5 High
- lenovo emc firmwareThe management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r...5.3 Medium
- jenkins, redhat openshift +1 moreExposure of Sensitive Information in Jenkins Core5.3 Medium
- apache activemqImproper Neutralization of Input During Web Page Generation in Apache ActiveMQ6.1 Medium
- falconsc wisepoint, wisepoint authenticator +1 moreThe management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22...6.1 Medium
- proftpd, fedoraproject fedora, opensuse +2 moreThe mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle...7.5 High
- apple mac os xdyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism...7.8 High
- siemens simatic s7 cpu 1200 firmwareSiemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program...6.5 Medium
- google androidSetup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate...6.1 Medium
- google androidThe BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in...7.5 High
- google androidThe BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in...7.5 High
- google androidThe Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain...5.3 Medium
- google androidlibmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive...5.3 Medium
- google androidThe caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in...5.9 Medium
- mozilla firefox, opensuse, oracle linux +2 moreMozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that...4.3 Medium
- mozilla firefox, opensuse, oracle linux +2 morebrowser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7...4.3 Medium
- drupal, debian linux +1 moreDrupal Reflected file download vulnerability6.4 Medium
- drupal, debian linux +1 moreDrupal Brute force amplification attacks via XML-RPC7.5 High
- moodleMoodle improper access control4.3 Medium
- zhuhai raysharp firmwareZhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote...9.8 Critical
- comcast xfinity home security systemComcast XFINITY Home Security System does not properly maintain base-station communication, which...6.5 Medium
- citrix netscalerThe Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and...6.1 Medium
- ibm security access manager 9.0 firmware, security access manager for web 7.0 firmware, security access manager for web 8.0 firmware +2 moreIBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before...7.5 High
- adobe connectAdobe Connect before 9.5.2 allows remote attackers to spoof the user interface via unspecified...5.3 Medium
- sauter moduweb visionSauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication...8.1 High
- phpmyadminphpMyAdmin Cryptographic Vulnerability7.5 High
- rubyonrails rails, ruby on rails +1 moreactionpack is vulnerable to remote bypass authentication3.7 Low
- kddi home spot cube firmwareKDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via...6.1 Medium
- phpmyadmin, fedoraproject fedora, opensuse leap +1 more +3 morephpMyAdmin Unsafe comparison of XSRF/CSRF token7.5 High
- lexmark printer firmwareRace condition in the initialization process on Lexmark printers with firmware ATL before ATL.02...9.8 Critical
- tuxfamily chronychrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when...8.1 High
- lenovo shareitLenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files...8.0 High
- google chromeThe CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in...4.3 Medium
- google chromeThe Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof...6.5 Medium
- mariadb, oracle mysql, canonical ubuntu linux +3 more +5 moreThe ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x...5.9 Medium
- cisco web security applianceThe proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000...7.5 High
- ibm infosphere master data managementIBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0...4.1 Medium
- microsoft windows 10The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511...8.1 High
- shellinabox project shellinabox, fedoraproject fedora +1 moreThe HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier...7.4 High
- xenThe hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of...5.0 Medium
- libtiffThe _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of...9.8 Critical
- ibm tivoli common reportingIBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0...2.5 Low
- nettle project nettle, canonical ubuntu linux, opensuse leap +1 more +3 morex86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and...9.8 Critical
- nettle project nettle, canonical ubuntu linux, opensuse leap +1 more +3 moreThe ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry...9.8 Critical
- ntp, novell suse openstack cloud, opensuse leap +6 more +8 moreThe ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77...4.3 Medium
- Show moreLoading…