CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- f-secure anti-virusF-Secure Anti-Virus does not properly interact with the processing of hcp:// URLs by the...6.4 Medium
- avg anti-virusAVG Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft...6.4 Medium
- symantec norton antivirusSymantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by...6.4 Medium
- mcafee virusscan enterpriseMcAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:/...6.4 Medium
- mcafee common management agentMcAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and...6.5 Medium
- openstack folsom, nova +1 moreArbitrary file overwrite in OpenStack Nova4.9 Medium
- xenThe handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x...1.9 Low
- ibm rational clearquestThe Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows...5.5 Medium
- ibm websphere mqThe Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows...3.5 Low
- siemens comosSiemens COMOS before 9.1 Patch 413, 9.2 before Update 03 Patch 023, and 10.0 before Patch 005...8.5 High
- mike peachey authen\The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote...5.0 Medium
- pizzashack rsshrssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted...2.1 Low
- moshe weitzman organic groupsThe Organic Groups (OG) module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict...5.0 Medium
- kristof de jaeger bundle copyThe Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for...6.0 Medium
- emil stjerneman linkitThe Linkit module 7.x-2.x before 7.x-2.3 for Drupal, when using an entity access module, does not...4.3 Medium
- jan kara linux diskquotaThe good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17...4.0 Medium
- iain gypsygypsy 0.8 does not properly restrict the files that can be read while running with root...1.9 Low
- amazon kindle touchThe Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so...9.3 High
- dir2webDir2web 3.0 stores sensitive information under the web root with insufficient access control,...5.0 Medium
- caucho resinCaucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended...6.4 Medium
- pbboardThe new_password page in PBBoard 2.1.4 allows remote attackers to change the password of...7.5 High
- pnp4nagiosPNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which...2.1 Low
- ibm global security kit, rational directory server, tivoli directory server +2 moreIBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server,...7.5 High
- opscode chefchef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x...6.5 Medium
- opscode chefchef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x...5.5 Medium
- opscode chefChef Improper Access Control vulnerability6.5 Medium
- gnu automakeThe "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world...4.4 Medium
- extplorereXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory,...3.6 Low
- debian logollogol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which...3.6 Low
- gnome screensavergnome-screensaver 3.4.x before 3.4.4 and 3.5.x before 3.5.4, when multiple screens are used, only...3.3 Low
- openvswitchOpen vSwitch 1.4.2 uses world writable permissions for (1) /var/lib/openvswitch/pki/controllerca...3.6 Low
- ibm power hardware management console firmware, systems director management console firmware +1 moreIBM Power Hardware Management Console (HMC) 7R3.5.0 before SP4, 7R7.1.0 and 7R7.2.0 before 7R7.2...7.2 High
- bitcoin wxbitcoin, core +1 morewxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions...7.5 High
- google chromeThe drag-and-drop implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and...4.3 Medium
- openstack essex, keystone, horizon +2 moreOpenStack Keystone token expiration issues4.9 Medium
- ibm scale out network attached storageIBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated...9.0 High
- mozilla bugzillaThe get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and...4.3 Medium
- mozilla bugzillaBugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead...4.3 Medium
- airdroidThe login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple...5.0 Medium
- novell zenworks configuration managementThe ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM)...6.8 Medium
- apple xcodeApple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of...5.0 Medium
- apple safariWebKit in Apple Safari before 6.0 does not properly handle file: URLs, which allows remote...7.1 High
- apple safariWebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows...4.3 Medium
- findingscience mod auth openidmod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db...2.1 Low
- apple safariApple Safari before 6.0 does not properly handle the autocomplete attribute of a password input...5.0 Medium
- apple safariApple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL.4.3 Medium
- moodlelib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3...4.0 Medium
- moodlemod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly...4.0 Medium
- moodlelib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict...3.5 Low
- moodleThe is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1...4.0 Medium
- Show moreLoading…