CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, seamonkey +1 moreThe implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5,...9.3 High
- ibm gx4004 ips-gx4004-ib-2 appliance, web application firewall, g400 ips-g400-ib-1 appliance +2 moreIBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2...5.0 Medium
- apache tomcat, commons daemon +1 morenative/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache...5.0 Medium
- citrix xenXen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that...7.4 High
- ibm tivoli federated identity managerIBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID...2.6 Low
- adobe air, flash player +1 moreAdobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186...6.4 Medium
- wordpressThe file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running ...9.3 High
- microsoft windows server 2003, windows xp, windows 2003 server +2 moreNDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2...7.2 High
- microsoft windows 7, windows server 2003, windows server 2008 +3 more +5 moreWinsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in...7.2 High
- ibm infosphere datastage, infosphere information server +1 moreIBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere...7.2 High
- ibm infosphere datastage, infosphere information server +1 moreIBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere...7.2 High
- mcafee saas endpoint protectionThe MyAsUtil ActiveX control in MyAsUtil5.2.0.603.dll in McAfee SaaS Endpoint Protection 5.2.1...6.8 Medium
- novell data synchronizer, mobility pack +1 moreThe Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not...5.0 Medium
- novell data synchronizer, mobility pack +1 moreThe Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows...5.0 Medium
- android browser, google android +1 moreThe Android browser in Android cannot properly restrict modifications to cookies established in...5.8 Medium
- opera browserOpera cannot properly restrict modifications to cookies established in HTTPS sessions, which...5.8 Medium
- apple safariApple Safari cannot properly restrict modifications to cookies established in HTTPS sessions,...5.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer cannot properly restrict modifications to cookies established in...5.8 Medium
- google chromeGoogle Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in...5.8 Medium
- mozilla firefoxMozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS...5.8 Medium
- emc captiva einputEMC Captiva eInput 2.1.1 before 2.1.1.37 does not restrict the origin of calls to ActiveX...5.8 Medium
- cisco sa500 software, sa520, sa520w +1 more +3 moreThe web-based management interface on Cisco SA 500 series security appliances with software...9.0 High
- chyrpupload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side...6.5 Medium
- drupalDrupal Access Control Bypass7.5 High
- redhat jboss enterprise application platform, jboss enterprise soa platform, jboss enterprise web platform +1 more +3 morejboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss...6.8 Medium
- redhat jboss enterprise application platform, jboss enterprise soa platform, jboss seam 2 framework +2 morejboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss...6.8 Medium
- qemuThe change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop...2.1 Low
- apple safari, webkit +1 moreApple Safari before 5.0.6 allows remote attackers to bypass the Same Origin Policy, and modify...5.8 Medium
- apple iphone osThe queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4...7.2 High
- hp windows event log smartconnector, arcsight c1000 appliance, arcsight c1300 appliance +4 more +6 moreWindows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world...3.6 Low
- otrs iphonehandle, otrs +1 moreThe iPhoneHandle package 0.9.x before 0.9.7 and 1.0.x before 1.0.3 in Open Ticket Request System ...6.5 Medium
- brocade bigiron rx switchBrocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source...5.0 Medium
- hongli lai libgnomesugnomesu-pam-backend in libgnomesu 1.0.0 prints an error message but proceeds with the non-error...7.2 High
- ibm websphere mqIBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 does not use the CRL Distribution...4.3 Medium
- mozilla firefoxMozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall...5.0 Medium
- mozilla firefoxThe WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict write...10.0 High
- mozilla firefoxThe WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict read...6.4 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not...5.0 Medium
- apple mac os xThe GPU support functionality in Mac OS X does not properly restrict rendering time, which allows...7.1 High
- microsoft windows xpThe GPU support functionality in Windows XP does not properly restrict rendering time, which...7.1 High
- simplemachines smfSSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly...10.0 High
- phpThe rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly...6.4 Medium
- microsoft windows 7, windows server 2003, windows server 2008 +3 more +5 moreThe Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows...7.2 High
- moodleMoodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations...4.0 Medium
- gnome gdmGNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web...7.2 High
- maynard johnson oprofileutils/opcontrol in OProfile 0.9.6 and earlier might allow local users to gain privileges via...7.2 High
- dotclearThe updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2...6.5 Medium
- vmware esx, esxi, fusion +2 more +4 moremount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4...6.3 Medium
- plonePlone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts5.5 Medium
- ibm tivoli management frameworkTivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 has an...9.0 High
- Show moreLoading…