CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- apache rampart\/cThe rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart...6.5 Medium
- cisco anyconnect secure mobility clientThe Start Before Logon (SBL) functionality in Cisco AnyConnect Secure Mobility Client (formerly...7.2 High
- cisco skinny client control protocol software, unified ip phone 7906, unified ip phone 7911g +12 more +14 moreCisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 do not properly...1.5 Low
- cisco skinny client control protocol software, unified ip phone 7906, unified ip phone 7911g +12 more +14 moreCisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 allow local...6.6 Medium
- cisco skinny client control protocol software, unified ip phone 7906, unified ip phone 7911g +12 more +14 moreThe su utility on Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.0...6.6 Medium
- apache subversionThe mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and...4.3 Medium
- walrus digit walrackWalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which...6.8 Medium
- ibm web content managerThe authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows...4.0 Medium
- google chrome osGoogle Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a ...7.2 High
- watchguard xcsThe STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O...6.8 Medium
- cmu cyrus imap serverThe STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O...5.1 Medium
- linux kernel, suse linux enterprise server +1 moreThe cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not...3.3 Low
- linux kernel, suse linux enterprise desktop +1 moreMultiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local...7.2 High
- smartertools smarterstatsThe (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the...5.0 Medium
- openswanOpenswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to...3.6 Low
- keepalivedThe pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666...3.6 Low
- apache tomcatAccess restriction bypass in Apache Tomcat4.3 Medium
- ibm datacap taskmaster captureIBM Datacap Taskmaster Capture 8.0.1 before FP1, when Windows Authentication is enabled, allows...6.8 Medium
- evan dandrea usb-creatorusb-creator-helper in usb-creator before 0.2.28.3 does not enforce intended PolicyKit...2.1 Low
- maharaMahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows...4.0 Medium
- maharaMahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and...6.5 Medium
- hp palm webosHP Palm webOS 1.4.5 and 1.4.5.1 does not properly restrict Plug-in Development Kit (PDK)...7.2 High
- novell suse linux enterprise, rubyforge rubygem-sqlite3 +1 moresqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges2.1 Low
- microsoft .net frameworkThe JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when...5.1 Medium
- ibm db2IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux, UNIX, and Windows does not properly enforce...4.9 Medium
- ibm db2IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux, UNIX, and Windows does not properly revoke...6.5 Medium
- ubuntu language-selectordbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not...7.2 High
- orbeon formsoxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms...6.4 Medium
- emc networkerEMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is...6.9 Medium
- google androidAndroid before 2.3 does not properly restrict access to the system property space, which allows...7.2 High
- skype for androidSkype for Android stores sensitive user data without encryption in sqlite3 databases that have...2.1 Low
- novell suse linux, pureftpd pure-ftpd +1 morepure-ftpd 1.0.22, as used in SUSE Linux Enterprise Server 10 SP3 and SP4, and Enterprise Desktop...4.4 Medium
- redhat satelliteRed Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which...5.5 Medium
- mono, novell moonlight +1 moreThe RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before...5.8 Medium
- ibm websphere application serverIBM WebSphere Application Server (WAS) 6.0.x through 6.0.2.43, 6.1.x before 6.1.0.37, and 7.0.x...6.8 Medium
- kevinmehall pithosPreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config...2.1 Low
- perlThe (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x...5.0 Medium
- ncpfsncpmount in ncpfs 2.2.6 and earlier does not remove the /etc/mtab~ lock file after a failed...4.4 Medium
- linux util-linuxmount in util-linux 2.19 and earlier does not remove the /etc/mtab.tmp file after a failed...3.3 Low
- gnu glibclocale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not...6.2 Medium
- phpboostPHPBoost 3.0 stores sensitive information under the web root with insufficient access control,...5.0 Medium
- nicholas thompson node quick findThe Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node...5.0 Medium
- novell opensuse build serviceThe API in SUSE openSUSE Build Service (OBS) 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows...6.4 Medium
- gnu glibcld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic...3.7 Low
- nicholas marriott tmuxtmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp...4.6 Medium
- aleksey xml security library, apple webkit +1 morexslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products,...5.1 Medium
- vmware vix api, workstation +1 moreVMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7...6.9 Medium
- opensuseThe aaa_base package before 11.3-8.9.1 in SUSE openSUSE 11.3, and before 11.4-54.62.1 in openSUSE...6.9 Medium
- cisco nac guest server, nac guest server software +1 moreThe default configuration of the RADIUS authentication feature on the Cisco Network Admission...5.0 Medium
- novell opensuse factorySUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web...6.9 Medium
- Show moreLoading…