CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- mosp kintai kanriMosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote...4.0 Medium
- google chromeGoogle Chrome before 23.0.1271.64 does not properly restrict the loading of an SVG subresource in...7.5 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X,...10.0 High
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock...3.6 Low
- morbus iff activismThe Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the ...7.5 High
- boombatower subuserThe Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions...4.0 Medium
- cisco prime data center network managerCisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to...10.0 High
- nancy wichmann announcementsThe Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with...3.5 Low
- matthias hutterer emailThe contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7...5.0 Medium
- mime mail module project mimemailThe Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files...4.0 Medium
- niif shibb authThe Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status...4.3 Medium
- earl dunovant monthly archive by node typeThe Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions...5.8 Medium
- location module project locationThe Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly...5.0 Medium
- acquia commonsThe commons_discussion_views_default_views function in modules/features/commons_discussion...5.0 Medium
- tomatocartTomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows...3.5 Low
- apache cloudstackCitrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make...10.0 High
- bestpractical request trackerBest Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled,...4.3 Medium
- bestpractical rtRequest Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to...5.0 Medium
- bestpractical rtfmFAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which...4.0 Medium
- bestpractical rtRequest Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users...3.5 Low
- tibco formvineThe server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access...7.5 High
- cups-pk-helper project cups-pk-helpercups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile...5.8 Medium
- atutor acontentuser/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access,...6.5 Medium
- atutor acontentATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or...7.5 High
- openfabrics ibacmibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite...3.6 Low
- gnome gnome-keyringGNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout,"...4.4 Medium
- redhat rhncfgRed Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak...2.1 Low
- redhat jboss enterprise application platform, mod cluster +1 moreImproper Access Control in JBoss mod_cluster4.3 Medium
- ibm aix, vios +1 moreThe FTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly manage...6.8 Medium
- mozilla firefox, seamonkey, thunderbird +2 moreMozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 allow remote attackers to bypass the...4.3 Medium
- webcalendar project webcalendarinstall/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify...7.5 High
- opencryptoki project opencryptokiopenCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world...2.9 Low
- fedoraproject crypto-utilsThe nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite...3.6 Low
- mozilla firefox, seamonkey, thunderbird +9 more +11 moreMozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird...9.3 High
- mozilla firefoxMozilla Firefox before 16.0 on Android assigns chrome privileges to Reader Mode pages, which...4.0 Medium
- oracle mysqlMySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain...2.1 Low
- vwar virtual warpopup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member...5.0 Medium
- bacula, debian linux +1 moreThe dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce...4.0 Medium
- memcache project memcacheThe Memcache module 5.x before 5.x-1.10 and 6.x before 6.x-1.6 for Drupal does not properly...4.3 Medium
- aidanlister regcodeThe Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the...5.0 Medium
- monkey-project monkeyMonkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during...4.7 Medium
- monkey-project monkeyMonkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI...6.9 Medium
- mavili guestbook project guestbookMavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and...7.5 High
- mavili guestbook project guestbookMavili Guestbook, as released in November 2007, stores guestbook.mdb under the web root with...5.0 Medium
- broadcom license softwareCA License (aka CA Licensing) before 1.90.03 allows local users to modify or create arbitrary...7.2 High
- broadcom license softwareCA License (aka CA Licensing) before 1.90.03 does not properly restrict system commands, which...7.2 High
- eucalyptusEucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services...3.5 Low
- eucalyptusEucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services...6.5 Medium
- eucalyptusThe Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying...5.0 Medium
- michael biebl policykitPolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the...6.9 Medium
- Show moreLoading…