CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- codedesign artime japanese inputThe ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for...5.0 Medium
- simejiThe Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files,...5.0 Medium
- ibm storwize, samba, canonical ubuntu linux +2 moreThe SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1...4.0 Medium
- xmlsoft libxml2, canonical ubuntu linux, debian linux +1 more +3 morelibxml2 through 2.9.1 does not properly handle external entities expansion unless an application...6.8 Medium
- openstack essex, folsom, grizzly +6 more +8 moreOpenstack nova: vnc proxy can connect to the wrong vm7.6 High
- mailup wp-mailupajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict...5.0 Medium
- mailup wp-mailupajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict...5.0 Medium
- canonical ubuntu linuxpam-xdg-support, as used in Ubuntu 12.10, does not properly handle the PATH environment variable,...7.2 High
- fedoraproject sssdThe Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when...4.9 Medium
- siemens simatic pcs7, wincc +1 moreSiemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not...4.0 Medium
- selinc acselerator quicksetSchweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak...6.2 Medium
- apple iphone osThe Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock...2.1 Low
- apple iphone oslockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the...1.9 Low
- ibm infosphere information serverThe installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and...7.2 High
- sambaSamba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world...6.0 Medium
- citrix access gatewayUnspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524...5.0 Medium
- zugec ivan keyboard shortcut utilityThe Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check...6.0 Medium
- tibco spotfire web playerThe Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5...6.4 Medium
- apple mac os xLogin Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the...4.9 Medium
- apache commons fileuploadIncorrect Default Permissions in Apache Commons FileUpload3.3 Low
- redhat libvirtlibvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users...3.6 Low
- microsoft windows 7, windows 8, windows server 2003 +4 more +6 moreThe USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows...7.2 High
- microsoft windows 7, windows 8, windows server 2003 +4 more +6 moreThe USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows...7.2 High
- microsoft windows 7, windows 8, windows server 2003 +4 more +6 moreThe USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows...7.2 High
- microsoft sharepoint foundation, sharepoint server +1 moreMicrosoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to...7.5 High
- redhat enterprise virtualization managerThe MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does...4.0 Medium
- redhat automatic bug reporting toolabrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows...6.9 Medium
- redhat jboss enterprise application platform, jboss enterprise web platform +1 moreThe default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss...7.5 High
- redhat aeolus conductorThe Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota...5.5 Medium
- redhat cloudforms cloud engineAeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world...2.1 Low
- inkscapeInkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might...4.4 Medium
- redhat cloudforms cloud engineaeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud...2.1 Low
- puppet, puppet enterprise, canonical ubuntu linux +2 morePuppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1...4.9 Medium
- moodleMoodle does not properly manage privileges for WebDAV repositories6.5 Medium
- moodleMoodle allows remote authenticated users to reassign notes4.0 Medium
- moodle, fedoraproject fedora +1 moreMoodle does not enforce the forceloginforprofiles setting5.0 Medium
- todd miller sudo, apple mac os x +1 moresudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not...4.4 Medium
- todd miller sudo, apple mac os x +1 moresudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or...4.4 Medium
- todd miller sudo, apple mac os x +1 moresudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does...4.4 Medium
- gnome screensaverThe default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition...7.2 High
- openstack essex, folsom, red hat openstack folsom for rhel 6 +2 more +4 morePackstack: packstack: arbitrary file overwrite via symlink attack8.8 High
- spreecommerce spreespree_auth_devise allows remote authenticated users to assign themselves arbitrary roles4.0 Medium
- xenoxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the...4.3 Medium
- xenThe do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not...4.6 Medium
- phpext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship...7.5 High
- todd miller sudo, apple mac os x +1 moresudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically...6.9 Medium
- gnu gdbGNU Project Debugger (GDB) before 7.5, when .debug_gdb_scripts is defined, automatically loads...6.9 Medium
- debian apache2The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy...4.6 Medium
- ryan davis ruby parserruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name2.1 Low
- katello, katello katello-configure +1 moremodules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak...2.1 Low
- Show moreLoading…