CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- sgi performance co-pilotThe (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow...2.1 Low
- samsung printer firmwareThe Samsung printer firmware before 20121031 has a hardcoded read-write SNMP community, which...7.5 High
- ruby-lang rubyThe rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0...5.0 Medium
- maharaMahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to...6.0 Medium
- xenThe (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page...4.4 Medium
- xenThe do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not...4.4 Medium
- citrix xenserver, xen +1 moreThe GNTTABOP_swap_grant_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix...6.9 Medium
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise soa platform +1 more +3 moreThe JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2...4.6 Medium
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise portal platform +2 more +4 moreThe (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss...7.5 High
- sinapsi esolar, esolar duo, esolar light +4 more +6 moreSinapsi eSolar Improper Authentication9.4
- sinapsi esolar, esolar duo, esolar light +4 more +6 moreSinapsi eSolar OS Command Injection10.0
- ibm websphere datapower xc10 applianceThe IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2...9.0 High
- xenThe x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does...3.3 Low
- xen, debian linux, fedoraproject fedora +1 more +3 moreThe x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not...5.8 Medium
- xen, opensuse +1 moreThe Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause...4.7 Medium
- munin-monitoring muninmunin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote...9.3 High
- munin-monitoring muninMunin before 2.0.6 stores plugin state files that run as root in the same group-writable...7.2 High
- moodleMoodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage...4.0 Medium
- moodleThe Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2...6.4 Medium
- moodleThe Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3...6.5 Medium
- moodlelib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated...4.0 Medium
- moodleMoodle Allows Unauthenticated Dropbox Access6.5 Medium
- mozilla firefoxThe Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not...9.3 High
- mozilla firefoxThe New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of...6.8 Medium
- apple cupsCUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web...7.2 High
- razorcmsrazorCMS 1.2 allows remote authenticated users to access administrator directories and files by...4.0 Medium
- nvidia unix graphic driverNVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to...7.2 High
- nspluginwrappernspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable...5.0 Medium
- gluster glusterfsGlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary...3.6 Low
- dflabs ptkDFLabs PTK 1.0.5 stores data files with predictable names under the web document root with...5.0 Medium
- quest intrustThe (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest...9.3 High
- havalite cmsHavalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient...5.0 Medium
- apache tomcatImproper Access Control in Apache Tomcat5.0 Medium
- mantisbtcore/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail...5.5 Medium
- mantisbtMantisBT before 1.2.12 does not use an expected default value during decisions about whether a...5.5 Medium
- vanillaforums vanilla, vanilla forums +1 moreThe edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify...3.5 Low
- typo3Typo3 Backend History Module Vulnerable to XSS4.0 Medium
- vmware player, workstation +1 moreVMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak...8.3 High
- microsoft .net frameworkThe code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and...9.3 High
- microsoft .net frameworkThe reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4...9.3 High
- c3-ilex eoscadaEOSCoreScada.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of...5.0 Medium
- openstack essex, folsom, image registry and delivery service \(glance\) +2 moreOpenStack Glance arbitrary deletion of non-protected images5.5 Medium
- openstack essex, folsom, image registry and delivery service \(glance\) +2 moreOpenStack Glance arbitrary deletion of non-protected images5.5 Medium
- drupalThe OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files...5.0 Medium
- drupalDrupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re...6.8 Medium
- isc innThe STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering...6.8 Medium
- uninett radsecproxyThe DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are...6.4 Medium
- uninett radsecproxyradsecproxy before 1.6.1 does not properly verify certificates when there are configuration...6.4 Medium
- advance productivity software dte axiomAdvanced Productivity Software DTE Axiom before 12.3.3 does not validate the registration ID,...6.4 Medium
- simon brown pebblePebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a...6.4 Medium
- Show moreLoading…