CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- athemeThe myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0...6.0 Medium
- ibm aix, vios +1 morefuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k...2.1 Low
- fedoraproject 389 directory server389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn...6.0 Medium
- drupalDrupal improper access restrictions4.0 Medium
- drupalThe image module in Drupal 7.x before 7.14 does not properly check permissions when caching...5.0 Medium
- drupalThe forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished...4.0 Medium
- springsource grailsVMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data...5.0 Medium
- condor project condorsrc/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not...4.0 Medium
- trevor mckay cumin, redhat enterprise mrg +1 moreCumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0,...4.9 Medium
- trevor mckay cumin, redhat enterprise mrg +1 moreCumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0,...5.0 Medium
- ubiquity slideshow team ubiquity-slideshow-ubuntuubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle...6.8 Medium
- justsystems atokThe ATOK application before 1.0.4 for Android allows remote attackers to read the learning...4.3 Medium
- ibm websphere application serverIBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0...3.3 Low
- apple iphone osThe System Logs implementation in Apple iOS before 6 does not restrict /var/log access by...5.0 Medium
- apple iphone osSafari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character...5.0 Medium
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state,...2.1 Low
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to...2.1 Low
- apple iphone osThe Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not...3.6 Low
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing,...2.1 Low
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to...4.6 Medium
- apple iphone osThe Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6...1.9 Low
- apple iphone osThe kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet...6.9 Medium
- apple safariThe Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the...4.3 Medium
- apple safariApple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents,...4.3 Medium
- wizonesolutions fillpdfThe Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to...5.0 Medium
- rivetcode rivettrackertorrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which...7.5 High
- moodlecourse/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks...5.5 Medium
- moodlewebservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does...4.9 Medium
- moodleMoodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass...4.0 Medium
- moodlerepository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote...4.0 Medium
- freedesktop spice-gtk, gtk libgio +1 morelibgio, when used in setuid or other privileged programs in spice-gtk and possibly other products...6.9 Medium
- openstack keystoneOpenStack Keystone does not invalidate existing tokens when granting or revoking roles4.0 Medium
- freedesktop libdbuslibdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly...6.9 Medium
- siemens simatic pcs7, wincc +1 moreWebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products,...5.0 Medium
- cososys endpoint protector appliace 4The CoSoSys Endpoint Protector 4 appliance establishes an EPProot password based entirely on the...7.5 High
- paypal ubercart payflowThe Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers...5.0 Medium
- silverstripeSilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with...6.0 Medium
- silverstripeSilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the...5.0 Medium
- wordpresswp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not...3.5 Low
- wordpressThe create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does...4.0 Medium
- wordpressThe XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly...6.5 Medium
- google chromeGoogle Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin...7.5 High
- google chromeGoogle Chrome before 18.0.1025308 on Android does not properly restrict access from JavaScript...9.3 High
- google chromeGoogle Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs,...5.0 Medium
- google chromeGoogle Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs,...5.0 Medium
- openkmadmin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges...4.0 Medium
- danielb cool aidCool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows...4.9 Medium
- mediawikiMediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password...5.0 Medium
- citrix xenserver, xen +1 moreThe set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix...2.1 Low
- joomla joomla\!Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain...5.0 Medium
- Show moreLoading…