CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- ibm smartcloud provisioningIBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify...4.9 Medium
- rubyonrails rails, ruby on rails +1 moreactionpack allows bypass of database-query restrictions6.4 Medium
- redhat jboss enterprise application platform, enterprise linux +1 moreThe EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise...5.5 Medium
- opensuseThe SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration...7.2 High
- cybozu garoonSession fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack...6.8 Medium
- osehra vistaThe M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to...7.5 High
- vmware esx, esxi, fusion +2 more +4 morelgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware...7.9 High
- cisco secure access control systemThe RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify...4.0 Medium
- suse webyast, novell suse lifecycle management server, suse studio onsite +2 moreWebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local...7.2 High
- novell suse cloudThe server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log...10.0 High
- opensuseyast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13...7.2 High
- quassel-irc quassel ircQuassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID...4.0 Medium
- apache subversion, mod dontdothat +1 moreThe is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0...2.6 Low
- satechi smart travel routerThe web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes...5.8 Medium
- ibm qradar security information and event managerThe WinCollect agent in IBM Security QRadar SIEM before 7.1.1.569824 allows remote attackers to...4.3 Medium
- wouter verhelst nbd, canonical ubuntu linux, debian linux +2 morenbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which...7.5 High
- jenkins-ci exclusionJenkins Exclusion Plugin allows Access to Resource Locks5.5 Medium
- sybase adaptive server enterpriseSAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5...9.0 High
- robert ancell lightdm, canonical ubuntu linux +1 moreLightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the...3.3 Low
- xen, opensuse +1 moreXen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB...7.9 High
- busybox, redhat enterprise linux, t-mobile tm-ac1900 +2 moreutil-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when...7.2 High
- cisco wireless lan controllerThe web interface on Cisco Wireless LAN Controller (WLC) devices does not properly restrict use...4.3 Medium
- pineapp mail-secure 5099skPineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does...7.2 High
- sap netweaverGRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via...6.4 Medium
- sap netweaver logviewerSAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended...6.4 Medium
- vmware player, workstation +1 moreVMware Workstation 9.x before 9.0.3 and VMware Player 5.x before 5.0.3 on Linux do not properly...7.2 High
- mozilla network security servicesThe CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS)...5.8 Medium
- ibm websphere application serverThe migration functionality in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0...3.5 Low
- blackberry linkBlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not...5.8 Medium
- cisco nexus 1000vThe license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for...6.8 Medium
- ibm cognos business intelligenceIBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0...4.0 Medium
- cisco server provisionerThe web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not...5.0 Medium
- google chromeGoogle Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions...5.8 Medium
- dlink dsl-2740b, dsl-2740b firmware +1 moreThe D-Link DSL-2740B Gateway with firmware EU_1.0, when an active administrator session exists,...7.6 High
- mediawiki, fedoraproject fedora, gentoo linux +2 moreMediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password...5.0 Medium
- cisco unified ip phone 8961, unified ip phone 9951, unified ip phone 9971 +1 more +3 moreThe firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory...6.6 Medium
- cisco content services gateway, ios +1 moreCisco IOS 12.4(24)MDB9 and earlier on Content Services Gateway (CSG) devices does not properly...6.4 Medium
- adobe coldfusionAdobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via...7.8 High
- lighttpd, debian linux, opensuse +2 morelighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3)...7.6 High
- samba, canonical ubuntu linux, debian linux +2 moreSamba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when...4.0 Medium
- microsoft windows 8, windows server 2012 +1 moreMicrosoft Windows 8 and Windows Server 2012, when Hyper-V is used, does not ensure memory-address...7.9 High
- ibm lotus sametimeThe Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict...2.9 Low
- ibm lotus sametimeThe Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated...3.5 Low
- ibm lotus sametimeThe Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated...3.5 Low
- openbsd opensshThe mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES...6.0 Medium
- isc bindThe Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6...6.8 Medium
- pineapp mail-securePineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by...8.5 High
- openstack folsom, grizzly, havana +2 moreOpenStack Compute Nova Improper Access Control6.4 Medium
- libguestfs, novell suse linux enterprise server, suse linux enterprise software development kit +2 moreThe guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or -...6.8 Medium
- smackcoders wp ultimate email marketer pluginThe WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly...6.4 Medium
- Show moreLoading…