CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- postgresqlCREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9...6.5 Medium
- cisco small business srp520-u series firmware, small business srp520 series firmware, small business srp521w +9 more +11 moreCisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices...7.8 High
- advantech webaccessAdvantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of...10.0 High
- landesk lenovo thinkmanagement consoleUnrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup...7.5 High
- claus due sysutilsThe System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to...5.0 Medium
- sean robertson forwardThe Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not...5.0 Medium
- dreamreport dream report, invensys wonderware hmi reports +1 moreInvensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream...9.3 High
- sybase m-business anywhereThe web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3...6.5 Medium
- likno allwebmenus pluginactions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass...7.5 High
- emc documentum xploreEMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for...4.0 Medium
- siemens simatic hmi panels, wincc, wincc flexible +2 more +4 moreThe HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA...10.0 High
- apple mac os x, mac os x server +1 moreQuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory...6.8 Medium
- mozilla firefox, seamonkey +1 moreMozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak...2.1 Low
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow...5.0 Medium
- phpPHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create...6.4 Medium
- redhat jboss enterprise application platformmod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes...7.5 High
- symantec pcanywhereSymantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka...6.8 Medium
- tencent qqpphotoThe Tencent QQPhoto (com.tencent.qqphoto) application 0.97 for Android does not properly protect...5.8 Medium
- tencent microblogpad, wblog +1 moreThe Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do...5.8 Medium
- tencent mobileqqThe Tencent MobileQQ (com.tencent.mobileqq) application 2.2 for Android does not properly protect...5.8 Medium
- tencent qqpimsecureThe Tencent QQPimSecure (com.tencent.qqpimsecure) application 3.0.2 for Android does not properly...5.8 Medium
- anguanjiaThe AnGuanJia (com.anguanjia.safe) application 2.10.343 for Android does not properly protect...5.8 Medium
- 360 kouxinThe 360 KouXin (com.qihoo360.kouxin) application 1.5.3 for Android does not properly protect data...5.8 Medium
- lucion scan to pdf freeThe Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly...5.8 Medium
- qiwi walletThe QIWI Wallet (ru.mw) application before 1.14.2 for Android does not properly protect data,...5.8 Medium
- 360 mobilesafeThe 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not...5.8 Medium
- ming blacklist freeThe Ming Blacklist Free (vc.software.blacklist) application 1.8.1 and 1.9.2.1 for Android does...5.8 Medium
- voxofonThe Voxofon (com.voxofon) application before 2.5.2 for Android does not properly protect data,...5.8 Medium
- nathanielkh limit my callThe Limit My Call (com.limited.call.view) application 2.11 for Android does not properly protect...5.8 Medium
- nimbuzzThe Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data...5.8 Medium
- hatena callconfirmThe CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not...5.8 Medium
- ubermedia ubersocialThe UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not...5.8 Medium
- cisco ip video phone e20, telepresence e20 software +1 moreCisco TelePresence Software before TE 4.1.1 on the Cisco IP Video Phone E20 has a default...10.0 High
- ibm websphere application serveriscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and...4.6 Medium
- linux kernelThe mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly...6.9 Medium
- apache tomcatImproper Authentication in Apache Tomcat5.0 Medium
- apache tomcatAuthentication Bypass in Apache Tomcat5.0 Medium
- roderich schupp par-packer moduleThe par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a...3.3 Low
- openstack essex, nova +1 moreNova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass...4.9 Medium
- roderich schupp par-packer moduleThe par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files...3.3 Low
- cluster resources torque resource managerTerascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when...4.9 Medium
- 3ssoftware codesysThe CmbWebserver.dll module of the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote...6.4 Medium
- microsoft windows xp, windows server 2003, windows server 2008 +1 more +3 moreThe Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP...6.9 Medium
- apache strutsApache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly...5.0 Medium
- apache strutsApache Struts's ParameterInterceptor component does not prevent access to public constructors6.4 Medium
- ecryptfs ecryptfs-utils, utils +1 moreThe lock-counter implementation in utils/mount.ecryptfs_private.c in ecryptfs-utils before 90...3.6 Low
- ecryptfs ecryptfs-utils, utils +1 moreutils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly maintain the mtab...2.1 Low
- ecryptfs ecryptfs-utils, utils +1 moreutils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint...2.1 Low
- ecryptfs ecryptfs-utils, utils +1 moreutils/mount.ecryptfs_private.c in ecryptfs-utils before 90 does not properly check mountpoint...4.6 Medium
- eeye digital security audits, retina network security scanner +1 moreeEye Audit ID 2499 in eEye Digital Security Audits 2406 through 2423 for eEye Retina Network...6.9 Medium
- Show moreLoading…