CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- adobe acrobat, acrobat reader +1 moreAdobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow...10.0 High
- adobe acrobat, acrobat reader +1 moreAdobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow...10.0 High
- microsoft windows 7, windows 8, windows rt +3 more +5 moreThe SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2...5.8 Medium
- microsoft windows 7, windows 8, windows rt +3 more +5 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2...7.2 High
- adobe coldfusionAdobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers...7.5 High
- redhat jboss enterprise application platform, red hat jboss enterprise application platform 6 for rhel 5, jboss enterprise application platform 6 for rhel 6 +4 more +6 moreJboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass5.3 Medium
- redhat jboss enterprise application platform, red hat jboss enterprise application platform 6 for rhel 5, jboss enterprise application platform 6 for rhel 6 +4 more +6 moreJboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization6.5 Medium
- apache cxfImproper Authentication in Apache CXF4.3 Medium
- redhat cloudforms, red hat cloudforms for rhel 6, cloudforms tools for rhel 5 +2 moreGrinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions3.3 Low
- redhat cloudformsproxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check...5.5 Medium
- redhat enterprise virtualization managerThe backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly...2.7 Low
- redhat enterprise virtualization managerRed Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions,...3.7 Low
- owncloud serverownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings...4.3 Medium
- steven jones contextThe Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not...5.0 Medium
- drupalDrupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might...5.0 Medium
- opera browserOpera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local...4.6 Medium
- opera browserOpera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS)...5.0 Medium
- lemonldap-ng lemonldap\LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso...7.5 High
- samsung samsungdiveThe Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices...2.9 Low
- sensiolabs symfonySymfony Access Control Vulnerability6.8 Medium
- sensiolabs symfonySymfony Allows URI Restrictions Bypass Via Double-Encoded String6.4 Medium
- openstack keystonetools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud ...2.1 Low
- ibm tivoli netviewUnspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows...7.2 High
- ibm rational automation frameworkIBM Rational Automation Framework (RAF) 3.x through 3.0.0.5 allows remote attackers to bypass...7.5 High
- epiqo emailThe Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module...2.6 Low
- marc ingram servicesThe Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote...2.1 Low
- m2osw tableofcontentsThe Table of Contents module 6.x-3.x before 6.x-3.8 for Drupal does not properly check node...4.3 Medium
- boatmob boat browser, boat browser mini +1 moreThe Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android...2.1 Low
- ovirt sanlockThe setup_logging function in log.h in SANLock uses world-writable permissions for /var/log...3.6 Low
- phpmyadminThe Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass...7.5 High
- apache tomcatCross-Site Request Forgery in Apache Tomcat4.3 Medium
- apache tomcatAuthentication Bypass in Apache Tomcat4.3 Medium
- sensiolabs symfonylib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary...5.0 Medium
- meizu mx, samsung galaxy note 2, galaxy s2 +2 moreThe kernel in Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly other Android devices,...9.3 High
- dlink dsl-2730uThe restricted telnet shell on the D-Link DSL2730U router allows remote authenticated users to...4.0 Medium
- adobe coldfusionAdobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting...4.4 Medium
- layton technology helpboxeditrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary...4.0 Medium
- laytontechnology helpboxLayton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain...6.5 Medium
- forescout counteractThe Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized...4.3 Medium
- ibm websphere message brokerIBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has...6.9 Medium
- user read-only project readonlyThe User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not...3.6 Low
- feeds project feedsThe Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's...4.3 Medium
- organic groups project groupsThe Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain...3.5 Low
- joomla joomla\!Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain...5.0 Medium
- joomla joomla\!Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient...7.5 High
- david alkire drag \& drop galleryUnspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote...5.0 Medium
- security questions project questionsThe Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does...5.0 Medium
- christian johansson restrict node page viewThe Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated...3.5 Low
- dominique clause search autocompleteThe Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict...5.0 Medium
- philip ludlam listhandlerThe Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when...7.5 High
- Show moreLoading…