CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- chaos tool suite project ctoolsThe Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict...3.5 Low
- acquia commons, commons wikis project wikis +1 moreThe Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1,...5.0 Medium
- acquia commons, commons group +1 moreThe Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1,...5.0 Medium
- drupalThe Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly...4.3 Medium
- drupalThe printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x...2.1 Low
- redhat enterprise linuxA certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2...4.7 Medium
- blackberry os, z10 +1 moreBlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a...6.2 Medium
- apache openjpaDeserialization of Untrusted Data in Apache OpenJPA7.5 High
- alstom micom s1 agile, micom s1 studio +1 moreAlstom Grid MiCOM S1 Agile before 1.0.3 and Alstom Grid MiCOM S1 Studio use weak permissions for...6.6 Medium
- cisco virtualization experience client 6000, virtualization experience client 6000 series firmware, virtualization experience client 6215 +2 moreThe firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating...6.8 Medium
- cisco telepresence tc softwareThe web portal in TC software on Cisco TelePresence endpoints does not require an exact password...4.3 Medium
- google chrome, debian linux +1 morebrowser/extensions/api/tabs/tabs_api.cc in Google Chrome before 28.0.1500.71 does not properly...5.0 Medium
- google chromeGoogle Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers...4.3 Medium
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 morewin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003...7.2 High
- microsoft windows 7, windows defender, windows server 2008 +2 moreThe signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server...6.9 Medium
- microsoft windows 7, windows 8, windows rt +5 more +7 morewin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003...7.2 High
- microsoft windows 7, windows 8, windows rt +5 more +7 morewin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003...7.2 High
- microsoft windows 7, windows 8, windows rt +5 more +7 morewin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003...7.2 High
- phusion passenger, redhat openshift +1 morePhusion Passenger Denial of Service4.6 Medium
- redhat enterprise linuxThe Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows...2.6 Low
- ibm aix, vios +1 moreThe TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled,...8.5 High
- phpmyadminphpMyAdmin Global variables scope injection vulnerability5.5 Medium
- mongodbMongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain...6.5 Medium
- redhat enterprise virtualization managerRed Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions...5.0 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly...4.0 Medium
- xenThe libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions...7.4 High
- xenXen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows...5.2 Medium
- wordpressWordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers...4.3 Medium
- wordpressWordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote...4.0 Medium
- wordpressThe HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet...4.3 Medium
- digital alert systems dasdec eas, monroe electronics r189 one-net eas +1 moreThe Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net...10.0 High
- digital alert systems dasdec eas, monroe electronics r189 one-net eas +1 moreThe web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe...7.8 High
- hp nonstop sql\/mxHP SQL/MX 3.0 through 3.2 on NonStop servers, when SQL/MP Objects are used, allows remote...6.0 Medium
- mozilla firefoxThe Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly...7.2 High
- mozilla firefoxThe getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a...4.3 Medium
- mozilla firefoxMozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism,...4.0 Medium
- mozilla firefoxMozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for...5.0 Medium
- mozilla firefox, thunderbird, thunderbird esr +2 moreThe XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7,...9.3 High
- mozilla firefox, thunderbird, thunderbird esr +2 moreThe SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7,...4.3 Medium
- mozilla firefox, thunderbird, thunderbird esr +2 moreMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and...4.3 Medium
- mozilla firefox, thunderbird, thunderbird esr +2 moreThe System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox...9.3 High
- fortinet fortiosFortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities,...6.5 Medium
- freebsdThe vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD...6.9 Medium
- canon mx922 printer, mg3100 printer, mg5300 printer +6 more +8 moreThe default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100,...7.5 High
- ibm lotus inotes, lotus notes, lotus notes traveler +2 morentmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1,...7.2 High
- ibm sterling connect direct user interfaceThe Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not...5.0 Medium
- cisco telepresence tc softwareThe firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement...8.3 High
- huawei seco versatile security managerHuawei Seco Versatile Security Manager (VSM) before V200R002C00SPC300 allows remote authenticated...9.0 High
- google chrome, chrome os +1 moreThe Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0...4.3 Medium
- project-redcap redcapREDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within...6.5 Medium
- Show moreLoading…