CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- linux kernelThe scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a...7.2 High
- freebsdThe nullfs implementation in sys/fs/nullfs/null_vnops.c in the kernel in FreeBSD 8.3 through 9.2...3.7 Low
- openstack keystoneOpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token5.0 Medium
- freebsdThe (1) IPv6 and (2) ATM ioctl request handlers in the kernel in FreeBSD 8.3 through 9.2-STABLE...6.9 Medium
- cisco mediasenseThe web interface in Cisco MediaSense does not properly protect the client-server communication...5.0 Medium
- hp linux imaging and printing projectThe check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through...6.9 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory...6.8 Medium
- dlink des-3810, des-3810 firmware +1 moreThe SSH implementation on D-Link Japan DES-3810 devices with firmware before R2.20.011 allows...6.3 Medium
- dlink dwl-2100ap, dwl-2100ap firmware +1 moreThe SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows...6.3 Medium
- apple iphone osWebKit in Apple iOS before 7 allows remote attackers to bypass the Same Origin Policy and obtain...4.3 Medium
- apple iphone osThe Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of...2.1 Low
- apple iphone osThe Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter...5.0 Medium
- apple iphone osThe Telephony subsystem in Apple iOS before 7 does not require API conformity for access to...4.3 Medium
- apple iphone osThe Sandbox subsystem in Apple iOS before 7 determines the sandboxing requirement for a #!...4.3 Medium
- apple iphone osSpringboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which...2.1 Low
- apple iphone osThe Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an...4.3 Medium
- apple iphone oskextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC...6.3 Medium
- apple iphone osIOKit in Apple iOS before 7 allows attackers to send user-interface events to the foreground app...2.6 Low
- apple iphone osData Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect...5.8 Medium
- robert ancell lightdmLight Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7...2.1 Low
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreMozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird...6.2 Medium
- mozilla firefox, seamonkey, thunderbird +1 more +3 moreMozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird...5.0 Medium
- dahuasecurity dvr0404hd-a, dvr0404hd-l, dvr0404hd-s +62 more +64 moreThe authorization implementation on Dahua DVR appliances accepts a hash string representing the...10.0 High
- dahuasecurity dvr0404hd-a, dvr0404hd-l, dvr0404hd-s +62 more +64 moreDahua DVR appliances have a small value for the maximum password length, which makes it easier...9.3 High
- eucalyptusWalrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus,...5.5 Medium
- openstack computeOpenStack Compute (Nova) Resource limit circumvention in Nova private flavors3.5 Low
- redhat ansibleAnsible Arbitrary File Overwrite Vulnerability3.3 Low
- redhat ansibleAnsible uses a socket with predictable filename in /tmp1.9 Low
- theforeman foreman, redhat openstack +1 moreapp/controllers/api/v1/hosts_controller.rb in Foreman before 1.2.2 does not properly restrict...7.5 High
- openstack novaOpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information6.0 Medium
- apple mac os xScreen Lock in Apple Mac OS X before 10.8.5 does not properly track sessions, which allows remote...5.5 Medium
- apple mac os xPower Management in Apple Mac OS X before 10.8.5 does not properly perform locking upon...3.3 Low
- apple mac os xInstaller in Apple Mac OS X before 10.8.5 provides an option to continue a package's installation...6.8 Medium
- apache subversionSvnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to...3.3 Low
- gnu glibc, canonical ubuntu linux, redhat enterprise linux +1 more +3 moreThe vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and...6.8 Medium
- cisco socialminerThe gadget implementation in Cisco SocialMiner does not properly restrict the content of GET...5.0 Medium
- cisco prime lan management solutionCisco Prime LAN Management Solution (LMS) does not properly restrict use of IFRAME elements,...4.3 Medium
- wiresharkThe dissect_nbap_T_dCH_ID function in epan/dissectors/packet-nbap.c in the NBAP dissector in...4.3 Medium
- mediawiki(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5)...5.0 Medium
- xenThe xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access...6.5 Medium
- citrix cloudportal services managerCitrix CloudPortal Services Manager (aka Cortex) 10.0 before Cumulative Update 3 does not...10.0 High
- wordpresswp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof...3.5 Low
- ibm rational requirements composerUnspecified vulnerability in IBM Rational Requirements Composer before 4.0.4 makes it easier for...4.4 Medium
- microsoft office, pinyin ime +1 moreMicrosoft Pinyin IME 2010, when used in conjunction with Microsoft Office 2010 SP1, does not...6.9 Medium
- sophos web applianceThe close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9...7.2 High
- advanceprotech advancewareAdvancePro Advanceware allows remote authenticated users to obtain sensitive information about...4.0 Medium
- ibm security appscanIBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout...1.7 Low
- debian phpbb3Phpbb3 before 3.0.11-4 for Debian GNU/Linux uses world-writable permissions for cache files,...2.1 Low
- trivantis coursemill learning management systemCoursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls,...6.0 Medium
- emc rsa archer egrcEMC RSA Archer GRC 5.x before 5.4 allows remote authenticated users to bypass intended access...6.0 Medium
- Show moreLoading…