CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- open-xchange serverOpen-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak...2.1 Low
- paloaltonetworks pan-osThe App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0...4.3 Medium
- cisco adaptive security appliance, adaptive security appliance software +1 moreThe protocol-inspection feature on Cisco Adaptive Security Appliances (ASA) devices does not...4.3 Medium
- fast permissions administration project permission administrationThe Fast Permissions Administration module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.3 for...7.5 High
- node access user reference project nodeaccess userreference moduleThe Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for...5.8 Medium
- ibm db2, db2 connect +1 moreIBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1...4.6 Medium
- intel wimax network serviceThe Trace_OpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule...2.1 Low
- vmware player, workstation +1 morevmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on...6.9 Medium
- ibm websphere portalIBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a...5.0 Medium
- monster menus project menusThe mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7...6.0 Medium
- google chrome, debian linux +1 moreThe SharedMemory::Create function in memory/shared_memory_posix.cc in Google Chrome before 29.0...5.0 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https...5.0 Medium
- puppet, puppet enterprise +1 morePuppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and...3.6 Low
- juniper junos space, junos space ja1500 appliance, junos space virtual appliance +2 moreJuniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does...4.0 Medium
- juniper junos space, junos space ja1500 appliance, junos space virtual appliance +2 moreJuniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does...4.0 Medium
- microsoft internet explorerThe Protected Mode feature in Microsoft Internet Explorer 7 through 10 on Windows Vista SP2,...7.6 High
- microsoft windows 7, windows 8, windows rt +5 more +7 moreMicrosoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008...10.0 High
- phpSession fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote...6.8 Medium
- schneider-electric citectscada, powerlogic scada, vijeo citect +2 moreSchneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic...6.9 Medium
- siemens comosThe client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0...7.2 High
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreMozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8,...5.4 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreThe Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8,...4.3 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreMozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8,...4.3 Medium
- symantec backup execSymantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions ...4.3 Medium
- cisco webex meetings serverCisco WebEx Meetings Server does not check whether a user account is active, which allows remote...4.0 Medium
- bitcoin corebitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which...5.0 Medium
- cisco unified computing systemThe C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly...5.0 Medium
- symantec web gateway, web gateway appliance 8450, web gateway appliance 8490 +2 moreThe management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect...7.2 High
- novell clientThe NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server...7.2 High
- fedoraproject 389 directory server, redhat directory server +1 moreThe Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict...4.0 Medium
- theforeman foreman, redhat openstack +1 moreThe create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows...6.0 Medium
- cisco webexThe Meeting Center component in Cisco WebEx 11 generates different error messages for invalid...4.0 Medium
- google chrome, debian linux +1 moreGoogle Chrome before 28.0.1500.95 does not properly handle frames, which allows remote attackers...5.8 Medium
- canonical ubuntu linuxA certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu...6.9 Medium
- freebsdThe vfs_hang_addrlist function in sys/kern/vfs_export.c in the NFS server implementation in the...6.4 Medium
- moodleThe LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3...4.3 Medium
- cisco identity services engineThe firewall subsystem in Cisco Identity Services Engine has an incorrect rule for open ports,...5.0 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 10 allows local users to bypass the elevation policy check...6.9 Medium
- cisco unified meetingplace web conferencingThe web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote...5.0 Medium
- redhat jboss enterprise application platform, jboss operations network, jboss web framework kit +5 more +7 moreRemote code execution due to insecure deserialization7.5 High
- moodlemod/feedback/lib.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x...4.0 Medium
- moodlemod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8,...4.0 Medium
- hp system management homepageHP System Management Homepage (SMH) before 7.2.1 allows remote attackers to bypass intended...5.0 Medium
- hp system management homepageHP System Management Homepage (SMH) before 7.2.1 allows remote attackers to bypass intended...5.0 Medium
- cisco iosThe default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS...5.0 Medium
- emc avamar server, avamar server virtual edition +1 moreEMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s...9.0 High
- parallels plesk panel, small business panel +1 moreThe default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business...7.5 High
- google glassGoogle Glass before XE6 does not properly restrict the processing of QR codes, which allows...6.9 Medium
- cisco unified ip phone 9951, unified ip phone 9971, unified ip phones 9900 series firmware +2 moreThe Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows...5.0 Medium
- quade edit limitThe Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to...5.0 Medium
- Show moreLoading…