CWE-254: 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10, windows server 2016 +1 moreTask Scheduler in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local...7.8 High
- citrix receiver desktopIncorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to...6.8 Medium
- avast business security, email server security, endpoint protection +8 more +10 moreAvast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x,...5.5 Medium
- curlA flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file...5.3 Medium
- google androidOn Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message...7.5 High
- hp system management homepage, hpe system management homepage before v7.6 +1 moreHPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive...6.5 Medium
- citrix netscaler application delivery controller firmwareUnauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0...8.8 High
- dotcmsIn dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct...7.5 High
- yandex browser, yandex n.v. browser for desktop +1 moreYandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9...7.3 High
- yandex browser, yandex n.v. browser for desktop +1 moreYandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2...7.3 High
- oracle micros xstore paymentUnspecified vulnerability in the Oracle Retail Xstore Payment component in Oracle Retail...6.7 Medium
- oracle solaris clusterUnspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3...3.3 Low
- oracle webcenter sitesUnspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 12...4.3 Medium
- ibm security guardium database activity monitorIBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and...3.7 Low
- adobe acrobat, acrobat reader dc, reader +1 more +3 moreAdobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006...9.8 Critical
- siemens simatic step 7Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly stores pre-shared key data in TIA...4.7 Medium
- tp-linkTP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that...7.5 High
- beckhoff embedded pc images, twincat, twincat components featuring automation device specification (ads) communication +2 moreBeckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts9.1 Critical
- ceph project ceph, redhat ceph storage +1 moreThe RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows...7.5 High
- djangoproject django, canonical ubuntu linux, debian linux +2 moreDjango CSRF Protection Bypass7.5 High
- apple safariThe Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address...3.5 Low
- apple mac os xPerl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism...5.3 Medium
- redhat quickstart cloud installerThe kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on...8.4 High
- lenovo biosThe BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s...7.8 High
- apple iphone osThe Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software...5.9 Medium
- cloudfoundry php-buildpack, pivotal cloud foundry elastic runtime +1 moreCloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before...7.5 High
- pivotal software cloud foundry elastic runtimePivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254...7.3 High
- microsoft windows 10, windows 7, windows 8.1 +4 more +6 moreThe Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and...3.3 Low
- microsoft internet explorerMicrosoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which...8.3 High
- microsoft officeThe Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to...3.3 Low
- google chrome, opensuse leap +1 moreThe bidirectional-text implementation in Google Chrome before 53.0.2785.89 on Windows and OS X...4.3 Medium
- google chrome, opensuse leap +1 moreThe AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google...6.5 Medium
- google chrome, opensuse leap +1 moreThe AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google...6.5 Medium
- google chrome, opensuse leap +1 moreGoogle Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not...6.5 Medium
- phpmyadminphpMyAdmin Authentication Bypass9.8 Critical
- phpmyadminphpMyAdmin Reflected File Download attack6.3 Medium
- phpmyadminAn issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page....5.4 Medium
- phpmyadminphpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention5.9 Medium
- broadcom fabric operating systemHPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to...6.5 Medium
- citrix xenapp, xendesktop +1 moreCitrix XenApp 6.x before 6.5 HRP07 and 7.x before 7.9 and Citrix XenDesktop before 7.9 might...9.8 Critical
- theforeman foremanThe (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1...8.8 High
- theforeman foremanThe (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1...5.0 Medium
- sophos mobile control eas proxySophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows...8.6 High
- microsoft windows 10, windows 8.1, windows rt 8.1 +2 more +4 moreMicrosoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and...4.9 Medium
- ibm aix, vios +1 moreIBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which...3.7 Low
- google chromeBlink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is...8.8 High
- mozilla firefoxMozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT...4.3 Medium
- portaudio project portaudioSource code is downloaded over cleartext HTTP in portaudio5.9 Medium
- google chromeThe Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement...8.8 High
- google chrome, v8 +1 moreobjects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not...8.8 High
- Show moreLoading…