CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- gentoo logrotateThe default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process...6.3 Medium
- gentoo logrotateThe default configuration of logrotate on Gentoo Linux uses root privileges to process files in...6.3 Medium
- gentoo logrotateThe default configuration of logrotate on Debian GNU/Linux uses root privileges to process files...6.3 Medium
- gnu glibc** DISPUTED ** ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users...6.9 Medium
- emc data protection advisor collector, oracle solaris sparc +1 moreEMC Data Protection Advisor Collector 5.7 and 5.7.1 on Solaris SPARC platforms uses weak...7.2 High
- openldapchain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a...4.6 Medium
- otrsOpen Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions,...6.0 Medium
- otrsThe ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0...6.5 Medium
- otrsThe customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0...4.0 Medium
- otrsOpen Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit...3.5 Low
- otrsOpen Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows...6.0 Medium
- otrsKernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS)...4.6 Medium
- otrsThe CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote...6.5 Medium
- otrsOpen Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the...6.5 Medium
- otrsKernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a...4.6 Medium
- postfixThe STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6...6.8 Medium
- balbir singh libcgroupThe cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group...2.1 Low
- redhat libvirtlibvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read...6.9 Medium
- apple safari, webkit +1 moreThe windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to...4.3 Medium
- apple safari, webkit +1 moreThe HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted...5.8 Medium
- apple safari, webkit, iphone os +2 moreWebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the...4.3 Medium
- ibm websphere application serverThe AuthCache purge implementation in the Security component in IBM WebSphere Application Server ...6.5 Medium
- ibm websphere application serverThe Administrative Console component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1...4.0 Medium
- ibm websphere application serverThe Security component in IBM WebSphere Application Server (WAS) before 7.0.0.15, when a J2EE 1.4...6.0 Medium
- ibm websphere application serverThe installer in IBM WebSphere Application Server (WAS) before 7.0.0.15 uses 777 permissions for...2.1 Low
- ruby-lang rubyThe safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev...5.0 Medium
- gplhost domain technologie controlshared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie...4.0 Medium
- bestpractical rtScrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access...4.0 Medium
- cisco adaptive security appliance, adaptive security appliance software, asa 5500 +14 more +16 moreCisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 before 8.0(5.23),...7.8 High
- cisco telepresence multipoint switch, telepresence multipoint switch software +1 moreThe administrative web interface on Cisco TelePresence Multipoint Switch (CTMS) devices with...8.0 High
- redhat enterprise linux, fedora, policycoreutils +2 moreThe seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of...6.9 Medium
- fedoraproject 389 directory server, redhat directory server +1 moreThe (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in...6.2 Medium
- metasploit frameworkThe installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited...6.2 Medium
- ibm filenet p8 business process manager, filenet p8 content engine, filenet p8 content manager +2 moreIBM FileNet P8 Content Engine (aka P8CE) 4.0.1 through 5.0.0, as used in FileNet P8 Content...5.0 Medium
- rubyonrails railsactionpack allows remote attackers to bypass intended access restrictions7.5 High
- dell dellsystemlite.scanner activex controlThe Dell DellSystemLite.Scanner ActiveX control in DellSystemLite.ocx 1.0.0.0 does not properly...5.0 Medium
- redhat icedtea-web, sun jdk +1 moreThe JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6...7.5 High
- ibm lotus connectionsIBM Lotus Connections 3.0, when IBM WebSphere Application Server 7.0.0.11 is used, does not...6.8 Medium
- microsoft excel, office, open xml file format converter +2 moreMicrosoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format...9.3 High
- microsoft powerpointMicrosoft PowerPoint 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML...9.3 High
- adobe acrobat, acrobat reader +1 moreAdobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows...9.3 High
- openbsd opensshThe key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy...5.0 Medium
- microsoft windows xp, windows 2003 server +1 moreThe Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3 and Server 2003...4.7 Medium
- google chromeGoogle Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might...7.5 High
- smartySmarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2)...9.3 High
- smartySmarty Does Not Consider Umask Values When Setting Permissions7.5 High
- ibm db2IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP2 on Linux, UNIX, and Windows does not...6.5 Medium
- emc networkerlibrpc.dll in nsrexecd in EMC NetWorker before 7.5 SP4, 7.5.3.x before 7.5.3.5, and 7.6.x before...6.4 Medium
- opera browserOpera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for...4.3 Medium
- cisco iosCisco IOS 12.4(11)MD, 12.4(15)MD, 12.4(22)MD, 12.4(24)MD before 12.4(24)MD3, 12.4(22)MDA before...6.4 Medium
- Show moreLoading…