CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- ibm tivoli federated identity manager, tivoli federated identity manager business gateway +1 moreIBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business...4.3 Medium
- pfsenseetc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509...7.5 High
- sopcastSopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows...7.2 High
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 moreThe Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2...9.3 High
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 moreThe Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2...8.5 High
- ctekproducts skyrouterapps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute...10.0 High
- wuzlyThe administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by...7.5 High
- linux kernel, suse linux enterprise server +1 moreThe Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local...4.6 Medium
- mozilla firefox, thunderbird +1 moreMozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar...6.8 Medium
- canonical ubuntu linux, debian linux, x.org x server +2 moreThe X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly...4.6 Medium
- gplhost domain technologie controlThe setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable...2.1 Low
- schneider-electric quantum ethernet module 140noe77100, quantum ethernet module 140noe77101, quantum ethernet module 140noe77111 +2 moreThe modbus_125_handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771...10.0 High
- hp application lifestyle managementThe GetInstalledPackages function in the configuration tool in HP Application Lifestyle...4.6 Medium
- artsoft rocks\'n\'diamondsArtsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to...3.6 Low
- emc rsa adaptive authentication on-premiseEMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2...6.8 Medium
- emc rsa adaptive authentication on-premiseEMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2...6.8 Medium
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 moreCsrsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in...7.2 High
- microsoft windows 7, windows server 2003, windows server 2008 +1 more +3 moreThe kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft pinyin ime, pinyin new experience style, pinyin simple fast style +2 moreThe Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME...7.2 High
- restorepointThe Tadasoft Restorepoint 3.2 evaluation image uses weak permissions (www write access) for...7.2 High
- tedfelix acpid2event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during...4.6 Medium
- apple safari, webkit, google chrome +2 moreWebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not...5.0 Medium
- google chromeGoogle Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same...5.0 Medium
- opera browserOpera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy...5.0 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same...5.0 Medium
- mozilla firefoxMozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin...5.0 Medium
- opera browserThe JavaScript engine in Opera before 11.60 does not properly implement the in operator, which...6.4 Medium
- opera browserOpera before 11.60 does not properly consider the number of . (dot) characters that...5.0 Medium
- vtiger crmvtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads...4.0 Medium
- google chromeThe JavaScript implementation in Google Chrome 4 does not properly restrict the set of values...5.0 Medium
- opera browserThe JavaScript implementation in Opera 10.5 does not properly restrict the set of values...5.0 Medium
- microsoft ie, internet explorer +1 moreThe JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly...5.0 Medium
- apple safariThe JavaScript implementation in Apple Safari 4 does not properly restrict the set of values...5.0 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreThe JavaScript implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and...5.0 Medium
- celeryproject celeryCelery local privilege escalation vulnerability6.9 Medium
- linux kernelThe hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of...2.1 Low
- hp digital sender 9200c, laserjet enterprise 500 color, color laserjet 3000 +38 more +40 moreThe default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx,...10.0 High
- ibm websphere mqIBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does...1.9 Low
- linux kernelThe kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the...4.0 Medium
- linux kernelThe user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local...2.1 Low
- apple mac os xThe kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x...7.6 High
- apple mac os xThe nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions...7.6 High
- ibm db2 tools for z\/osThe web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query...5.0 Medium
- microsoft windows 7, windows server 2008 +1 moreMicrosoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce...3.6 Low
- apache tomcatorg/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not...4.4 Medium
- ibm aixIBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls,...4.9 Medium
- apple ipad2, iphone os +1 moreThe Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the...1.2 Low
- adobe air, flash player +1 moreAdobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux,...9.3 High
- emc rsa key manager applianceEMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does...9.3 High
- emc documentum eroomThe file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not...8.5 High
- Show moreLoading…