CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- maharaMahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote...6.0 Medium
- skyarc autotagging, duplicateentry, mailpack +2 more +4 moreSKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and...5.5 Medium
- investintech slimpdf readerInvestintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function...9.3 High
- investintech slimpdf readerInvestintech.com SlimPDF Reader does not properly restrict read operations during block data...9.3 High
- investintech slimpdf readerInvestintech.com SlimPDF Reader does not properly restrict write operations, which allows remote...9.3 High
- google app engine python sdkThe sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly...7.2 High
- google app engine python sdkThe sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly...7.2 High
- google app engine python sdkThe FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before...7.2 High
- ibm websphere application serverThe Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server...5.0 Medium
- torTor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part...5.8 Medium
- cisco nx-os, unified computing system, unified computing system infrastructure and unified computing system software +2 moreCisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2...6.8 Medium
- cybozu officeCybozu Office before 8.0.0 allows remote authenticated users to bypass intended access...5.5 Medium
- rim blackberry enterprise serverThe BlackBerry Collaboration Service in Research In Motion (RIM) BlackBerry Enterprise Server ...6.5 Medium
- cisco show and shareCisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote attackers to access...7.5 High
- apple mac os x, mac os x server +1 moreOpen Directory in Apple Mac OS X 10.7 before 10.7.2 does not require a user to provide the...6.5 Medium
- apple iphone osThe Data Access component in Apple iOS before 5 does not properly handle the existence of...2.1 Low
- apple safariApple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which...6.8 Medium
- apple mac os x, mac os x server +1 moreOpen Directory in Apple Mac OS X 10.7 before 10.7.2, when an LDAPv3 server is used with RFC 2307...6.8 Medium
- apple mac os x, mac os x server +1 moreThe SMB File Server component in Apple Mac OS X 10.7 before 10.7.2 does not prevent all guest...5.0 Medium
- apple mac os x, mac os x server +1 moreThe kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for...2.1 Low
- apple mac os x, mac os x server +1 moreThe kernel in Apple Mac OS X before 10.7.2 does not properly prevent FireWire DMA in the absence...2.1 Low
- apple mac os x, mac os x server +1 moreIOGraphics in Apple Mac OS X through 10.6.8 does not properly handle a locked-screen state in...4.6 Medium
- apple mac os x, mac os x server +1 moreThe File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X...7.6 High
- apple mac os x, mac os x server +1 moreThe CoreProcesses component in Apple Mac OS X 10.7 before 10.7.2 does not prevent a system window...4.6 Medium
- microsoft windows xp, ancillary function driver (afd.sys), windows server 2003 +2 moreafd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2...7.8 High
- microsoft .net framework, silverlight +1 moreMicrosoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0...9.3 High
- plone cmfeditions, plone +1 morePlone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable9.3 High
- sun opensolaris, sunos +1 moreThe labeled networking implementation in Solaris Trusted Extensions in Sun Solaris 10 and...8.5 High
- basercmsBaserCMS privilege escallation4.9 Medium
- puppetPuppet uses predictable filenames, allowing arbitrary file overwrite6.2 Medium
- mozilla firefox, seamonkey +1 moreMozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4...3.5 Low
- newgensoft omnidocsNewgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified...7.5 High
- opensslcrypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure...5.0 Medium
- adobe flash playerAdobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3...5.0 Medium
- linux kernelThe osf_wait4 function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the...7.2 High
- google chromeGoogle V8, as used in Google Chrome before 14.0.835.163, does not properly restrict access to...7.5 High
- emc avamarEMC Avamar 4.x, 5.0.x, and 6.0.x before 6.0.0-592 allows remote authenticated users to modify...7.7 High
- adobe acrobat, acrobat reader +1 moreAdobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allow...9.3 High
- microsoft windows server 2003, windows 2003 server, windows server 2008 +2 moreWINS in Microsoft Windows Server 2003 SP2 and Server 2008 SP2, R2, and R2 SP1 allows local users...7.2 High
- cisco nexus 3000, nexus 5000, nx-os +2 moreThe ACL implementation in Cisco NX-OS 5.0(2) and 5.0(3) before 5.0(3)N2(1) on Nexus 5000 series...5.0 Medium
- mark stosberg data\The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled...4.3 Medium
- apache libcloudApache Libcloud does not verify SSL certificates for HTTPS connections4.3 Medium
- ibm rational build forgeIBM Rational Build Forge 7.1.2 relies on client-side JavaScript code to enforce the EditSecurity...4.0 Medium
- linux kernelfs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/###...2.1 Low
- fuseCertain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not...3.3 Low
- fusefusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or...3.3 Low
- apache tomcatApache Tomcat Allows Remote Attackers to Spoof AJP Requests7.5 High
- Show moreLoading…