CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- moodleMoodle Authentication Bypass in File Upload4.0 Medium
- symantec web gatewayThe management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to...5.0 Medium
- symantec web gatewayThe management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain...7.2 High
- wordpressWordPress before 3.4.1 does not properly restrict access to post contents such as private or...5.0 Medium
- wordpressThe map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when...2.6 Low
- openstack diablo, essex, folsom +2 moreOpenStack Nova Arbitrary file injection/corruption through directory traversal issues5.5 Medium
- moodleMoodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows...4.0 Medium
- moodleadmin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3...6.5 Medium
- moodleMoodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated...5.5 Medium
- moodleMoodle Authentication Bypass in Question-Bank4.0 Medium
- moodleMoodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass...4.0 Medium
- moodleMoodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the...4.0 Medium
- phpThe SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir...5.0 Medium
- moodleThe command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not...5.0 Medium
- moodlebackup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not...5.5 Medium
- moodleMoodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1)...6.5 Medium
- florian weber spacesThe Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object...7.5 High
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreThe Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreMozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0,...5.0 Medium
- eucalyptusThe VMware Broker in Eucalyptus 2.0.3 and 3.0.x before 3.0.2 does not properly authenticate SOAP...7.5 High
- eucalyptusThe Walrus service in Eucalyptus 2.0.3 and 3.0.x before 3.0.2 allows remote attackers to gain...7.5 High
- moodleThe self-enrolment functionality in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 allows...5.5 Medium
- mozilla firefoxMozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context...4.3 Medium
- emc celerra network server, vnx, vnxe +2 moreEMC Celerra Network Server 6.x before 6.0.61.0, VNX 7.x before 7.0.53.2, and VNXe 2.0 and 2.1...6.5 Medium
- moodleMoodle does not properly restrict comment capabilities6.4 Medium
- moodlelib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect...5.5 Medium
- moodleThe moodle_enrol_external:role_assign function in enrol/externallib.php in Moodle 2.0.x before 2...6.5 Medium
- moodleMoodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory6.4 Medium
- moodleMoodle does not recogniz configuration setting that makes e-mail addresses visible only to course members4.0 Medium
- moodleMoodle does not force password changes for autosubscribed users6.8 Medium
- moodleMoodle Incorrect Default Settings5.5 Medium
- suckless slockslock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might...3.6 Low
- puppet, puppet enterprise, canonical ubuntu linux +4 more +6 morePupper does not properly restrict characters in Common Name field of Certificate Signing Request4.3 Medium
- puppet, puppet enterprise +1 morePuppet allows local users to obtain sensitive configuration information2.1 Low
- moodleMoodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended...5.0 Medium
- moodleMoodle does not properly restrict access to category and course data5.0 Medium
- microsoft officeMicrosoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft...6.9 Medium
- microsoft office web apps, sharepoint server +1 moreMicrosoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and...5.5 Medium
- apache org.apache.sling.servlets.postApache Sling POST Servlets Denial of Service Vulnerability5.0 Medium
- yomecolle nec biglobe yome collectionThe NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers...5.0 Medium
- symantec message filterBrightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment...3.3 Low
- redhat automatic bug reporting toolThe C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does...1.9 Low
- fedoraproject 389 directory serverThe acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server...2.3 Low
- fedoraproject anacondaThe bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions...2.1 Low
- mantisbtMantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated...4.9 Medium
- pippin williamson font uploaderUnrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for...7.5 High
- puppet, puppet enterprise +1 morePuppet allows local users to overwrite arbitrary files via a symlink attack3.6 Low
- ibm aix, vios +1 moreThe default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02,...7.2 High
- alexis wilke protected nodeThe Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node...7.5 High
- authoring html 6.x-1.0classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1...3.5 Low
- Show moreLoading…