CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- owncloud, owncloud server +1 moreappconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote...5.0 Medium
- apache strutsDenial of service in Apache Struts5.0 Medium
- openstack essex, horizon +1 moreOpenStack Keystone Allows Remote User Account Creation4.3 Medium
- dell crowbarThe Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer...4.6 Medium
- moinmo moinmoinMoinMoin Improper Access Control6.0 Medium
- brian altenhofel slideboxThe Slidebox module before 7.x-1.4 for Drupal does not properly check permissions, which allows...5.0 Medium
- mozilla bugzillaBugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3,...5.0 Medium
- symantec pgp universal serverSymantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that...2.9 Low
- obm open business managementOpen Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain...5.0 Medium
- john franklin advertisementThe Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to...5.0 Medium
- digium asterisk, certified asterisk +1 morechannels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1,...6.0 Medium
- sophos safeguard enterpriseThe Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based...3.3 Low
- ibm websphere mqIBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the...4.3 Medium
- tedfelix acpid2samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program...4.4 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreThe nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7,...6.8 Medium
- mozilla firefoxThe debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote...7.6 High
- mozilla firefoxMozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which...9.3 High
- symantec messaging gatewaySymantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account,...7.9 High
- giantrobot zipcartThe ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead...6.0 Medium
- gizra og vocabThe Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote...2.1 Low
- jason savino fpThe Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer...5.0 Medium
- yaml-fuer-drupal linkcheckerincludes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does...5.0 Medium
- danielb finderThe finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x...6.0 Medium
- rik de boer revisioningThe hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks...6.4 Medium
- pythonPython 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them...1.9 Low
- google tunnelblickTunnelblick 3.3beta20 and earlier allows local users to gain privileges by using a crafted Info...4.4 Medium
- google tunnelblickTunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN...6.9 Medium
- google tunnelblickTunnelblick 3.3beta20 and earlier relies on a test for specific ownership and permissions to...7.2 High
- bluecoat proxysg, sgos, proxysg sg210-10 +13 more +15 moreThe Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x...5.0 Medium
- bluecoat proxysg, sgos, proxysg sg210-10 +13 more +15 moreBlue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x...9.3 High
- websense email securityThe Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in...5.0 Medium
- silverstripeThe deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3...5.0 Medium
- silverstripeMember_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote...5.0 Medium
- silverstripeSilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via...4.0 Medium
- silverstripeSilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows...4.3 Medium
- silverstripeSilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the...5.0 Medium
- emc applicationxtender desktop, applicationxtender web access .net +1 moreEMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5...7.5 High
- icingaThe database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1...7.5 High
- postgresqlThe libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0...4.9 Medium
- websense web filter, web security, web security gateway +1 more +3 moreThe Investigative Reports web interface in the TRITON management console in Websense Web Security...7.5 High
- websense web filter, web security +1 moreThe Remote Filtering component in Websense Web Security and Web Filter before 7.1 Hotfix 66...2.1 Low
- websense, websense web filter, web security +2 moreThe ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6...4.3 Medium
- websense email securityWebsense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based...5.0 Medium
- mcafee epolicy orchestratorMcAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass...4.0 Medium
- mcafee application control, change control +1 moreMcAfee Application Control and Change Control 5.1.x and 6.0.0 do not enforce an intended password...5.0 Medium
- mcafee enterprise mobility manager, enterprise mobility manager agent +1 moreMcAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time...3.5 Low
- mcafee email and web security, email gateway +1 moreMcAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee...3.5 Low
- mcafee email and web security, email gateway +1 moreMcAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee...4.0 Medium
- mcafee email and web security, email gateway +1 moreMcAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee...4.9 Medium
- mcafee virusscan enterpriseMcAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging...2.6 Low
- Show moreLoading…