CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- cisco 5500 series adaptive security appliance, adaptive security appliance software, asa 5500 +2 moreThe vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505...6.8 Medium
- cisco unified computing system 6120xp fabric interconnect, unified computing system 6140xp fabric interconnect, unified computing system 6248up fabric interconnect +3 more +5 moreThe login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS...9.3 High
- lexmark markvisionLexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789, which...9.3 High
- linux kernelThe scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly...1.9 Low
- linux kernelThe clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly...4.7 Medium
- linux kernelThe create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not...2.1 Low
- cisco unified contact center express editor softwareThe scripts editor in Cisco Unified Contact Center Express (aka Unified CCX) does not properly...5.0 Medium
- cisco firewall services module, adaptive security appliance software +1 moreThe time-based ACL implementation on Cisco Adaptive Security Appliances (ASA) devices, and in...5.0 Medium
- hp elitepadHP ElitePad 900 PCs with BIOS F.0x before F.01 Update 1.0.0.8 do not enable the Secure Boot...7.2 High
- schneider-electric micom s1 studioThe installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for...6.6 Medium
- xenXen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain...4.7 Medium
- canonical ubuntu linux, x x.org-xserver +1 moreX.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input...2.1 Low
- google chrome osGoogle Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D...5.0 Medium
- google chrome osGoogle Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D...5.0 Medium
- fenrir-inc sleipnir mobileThe Sleipnir Mobile application 2.8.0 and earlier and Sleipnir Mobile Black Edition application 2...5.8 Medium
- canarylabs trendlinkThe SaveToFile method in a certain ActiveX control in TrendDisplay.dll in Canary Labs TrendLink 9...8.5 High
- xenXen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen...4.4 Medium
- redhat jboss enterprise portal platformThe GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote...5.0 Medium
- ibm cognos disclosure managementThe EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control, as used in Edraw Office Viewer Component,...9.3 High
- cisco unified meetingplace web conferencing serverCisco Unified MeetingPlace Web Conferencing Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1...9.3 High
- redhat openstack essex, openstack folsom +1 moreRed Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable...2.1 Low
- adobe shockwave playerAdobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which...10.0 High
- microsoft sharepoint serverMicrosoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not...3.5 Low
- dan kubb extlibextlib does not properly restrict casts of string values7.5 High
- jnunemaker httpartyHTTParty does not restrict casts of string values7.5 High
- john nunemaker crackcrack does not properly restrict casts of string values7.5 High
- gluster glusterfs, redhat storage management console, storage native client +1 more +3 moreThe GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server...2.1 Low
- ibm scale out network attached storageIBM Scale Out Network Attached Storage (SONAS) 1.3 before 1.3.2.3 requires cleartext storage of...3.5 Low
- linux kernelThe clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a...7.2 High
- postgresqlPostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8...10.0 High
- postgresql, canonical ubuntu linux +1 morePostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION...4.0 Medium
- mozilla firefoxMozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreThe System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x...10.0 High
- candlepinproject candlepin, redhat subscription asset manager +1 moreCandlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not...2.1 Low
- ibm infosphere replication serverThe web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7...4.0 Medium
- omron openwnnThe OMRON OpenWnn application before 1.3.6 for Android uses weak permissions for unspecified...4.3 Medium
- ibm security appscanIBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends...4.3 Medium
- novell sentinel log managerNovell Sentinel Log Manager before 1.2.0.3 allows remote attackers to create data retention...4.3 Medium
- mcafee virtual technician, epo mcafee virtual technician +1 moreAn ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101...8.2 High
- google chromeGoogle Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka...7.5 High
- google chromeThe extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the...7.5 High
- google chromeGoogle Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against...7.5 High
- google chromeThe Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use...6.8 Medium
- google chromeGoogle Chrome before 26.0.1410.43 does not prevent navigation to developer tools in response to a...6.8 Medium
- chris desautels node parameter controlThe Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the...6.4 Medium
- banckle chat project chatThe admin page in the Banckle Chat module for Drupal does not properly restrict access, which...10.0 High
- david alkire email2imageThe email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes,...5.0 Medium
- bart feenstra paymentThe Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to...5.0 Medium
- pm9 flickwnnThe FlickWnn (aka OpenWnn/Flick support) application 2.02 and earlier for Android uses weak...5.0 Medium
- cob\'s products cobimeThe COBIME application before 0.9.4 for Android uses weak permissions for unspecified files,...5.0 Medium
- Show moreLoading…