CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- scott reynen node embedThe node selection interface in the WYSIWYG editor (CKEditor) in the Node Embed module 6.x-1.x...4.3 Medium
- moshe weitzman organic groupsThe default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not...6.8 Medium
- adam ross tokenauthThe Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly...5.0 Medium
- blaine lang filedepotThe filedepot module 6.x-1.x before 6.x-1.3 for Drupal, when accessed using multiple different...5.1 Medium
- antoine beaupre hostmasterThe Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users...5.8 Medium
- tony freixas ubercart product keysThe Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access...5.0 Medium
- mantisbtbug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold...3.6 Low
- mantisbtThe SOAP API in MantisBT before 1.2.9 does not properly enforce the...3.6 Low
- mantisbtMantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier...6.4 Medium
- mantisbtThe access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not...4.3 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request4.3 Medium
- rubyonrails rails, ruby on rails +1 moreAction Pack contains database-query restrictions bypass6.4 Medium
- ibm aixlibodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a...6.9 Medium
- symantec liveupdate administratorSymantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for...6.9 Medium
- ibm lotus expeditorThe web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not...5.0 Medium
- linux kernelThe robust futex implementation in the Linux kernel before 2.6.28 does not properly handle...7.2 High
- linux kerneldrivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary...3.6 Low
- w1.fi hostapdhostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd...2.1 Low
- umich libgssapi, libgssglue +1 morelibgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to...6.2 Medium
- ibm websphere application serverThe Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not...4.3 Medium
- wordpress fcchat widgetUnrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1...6.8 Medium
- nmedia member conversationUnrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin...7.5 High
- redhat libvirtlibvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when...3.7 Low
- mantisbtMantisBT before 1.2.11 does not check the delete_attachments_threshold permission when...3.6 Low
- mantisbtThe mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly...7.5 High
- openssl** DISPUTED ** OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client...5.0 Medium
- jquindlen wpstorecartUnrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30...10.0 High
- rbx gallery galleryUnrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for...10.0 High
- opera browserOpera before 11.65 does not ensure that the address field corresponds to the displayed web page...4.3 Medium
- opera browserOpera before 11.65 does not ensure that the address field corresponds to the displayed web page...2.6 Low
- opera browserOpera before 11.65 does not properly restrict the reading of JSON strings, which allows remote...5.0 Medium
- efstechnology autoform pdm archiveAutoFORM PDM Archive before 7.0 implements user accounts in a way that allows for JMX Console...6.0 Medium
- efstechnology autoform pdm archiveThe administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization...6.5 Medium
- efstechnology autoform pdm archiveThe web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements,...6.5 Medium
- linux kernelThe osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on...2.1 Low
- bloxx web filteringBloxx Web Filtering before 5.0.14 does not properly interpret X-Forwarded-For headers during...5.0 Medium
- bloxx web filteringBloxx Web Filtering before 5.0.14 does not use a salt during calculation of a password hash,...5.8 Medium
- emerson deltav, deltav proessentials scientific graph, deltav workstation +2 moreAn unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and...6.4 Medium
- collabnet scrumworksThe server in CollabNet ScrumWorks Pro before 6.0 allows remote authenticated users to gain...6.5 Medium
- dotcmsdotCMS allows remote authenticated users to execute arbitrary Java code6.0 Medium
- canonical ubuntu linux, gnome update-manager-core +1 moreDistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04,...2.1 Low
- globus toolkitThe GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does...7.6 High
- openstack novaOpenstack Compute (Nova) Denial of service via network request that triggers large number of iptables rules3.5 Low
- mit kerberos 5server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10...5.5 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreThe Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and...7.2 High
- bestpractical rtBest Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode...6.5 Medium
- bestpractical rtBest Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to...7.5 High
- logitech lan-w300n\/ru2 firmwareLogitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access,...10.0 High
- zte score mThe ZTE sync_agent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523...10.0 High
- seagate blackarmor nasd41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor...10.0 High
- Show moreLoading…