CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac...10.0 High
- microsoft windows 7win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not...7.2 High
- juniper junosJuniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12...7.2 High
- apache cloudstackThe (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow...4.0 Medium
- apache cloudstackThe virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in...2.8 Low
- springsource spring frameworkMissing XML Validation in Spring Framework6.8 Medium
- springsource spring frameworkCross-Site Request Forgery in Spring Framework6.8 Medium
- symantec endpoint protectionThe Application/Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP...4.6 Medium
- amberdms billing systemAmberdms Billing System (ABS) before 1.4.1 does not properly implement blacklisting after...6.4 Medium
- ecava integraxorEcava IntegraXor Exposure of Access Control List Files to an Unauthorized Control Sphere7.5
- synology diskstation managerwebman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4...10.0 High
- cisco unified communications managerThe administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier...4.0 Medium
- cisco context directory agentThe administrative interface in Cisco Context Directory Agent (CDA) does not properly enforce...4.9 Medium
- redhat libvirtThe lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does...2.1 Low
- op5 monitorop5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows...10.0 High
- linuxcontainers lxcThe lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write...7.2 High
- realvncRealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a...7.2 High
- openstack folsom, grizzly, havana +1 more +3 moreOpenStack Nova uses insecure keystone middleware tmpdir by default2.1 Low
- xenXen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1)...5.2 Medium
- redhat jboss operations networkRed Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2)...2.1 Low
- typo3TYPO3 Improper Access Control vulnerability4.9 Medium
- typo3TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component4.0 Medium
- ibm security access manager for enterprise single sign-onThe IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM...3.5 Low
- redhat enterprise mrgcumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows...6.5 Medium
- vmware esx, esxi +1 moreVMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary...4.4 Medium
- ibm websphere portalIBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6...5.0 Medium
- ibm websphere portalIBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always"...5.0 Medium
- ibm websphere portalIBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not...4.3 Medium
- ibm websphere portalIBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF09, when Content Template Catalog 4.0 is used, does...4.9 Medium
- mike stefanello og featuresThe OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that...5.8 Medium
- apple safariApple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin...6.4 Medium
- cisco webex training centerThe registration component in Cisco WebEx Training Center provides the training-session URL...5.0 Medium
- cisco webex meeting centerCisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject...3.5 Low
- google androidAndroid 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device...8.8 High
- acme thttpd, open source development team sthttpd, fedoraproject fedora +2 more +4 morethttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log...2.1 Low
- xenXen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the...6.8 Medium
- owncloud, owncloud server +1 moreThe admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access...6.8 Medium
- mod nss project nss, redhat enterprise linux +1 moremod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does...4.0 Medium
- openstack heatThe ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before...4.0 Medium
- openstack heatThe cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1...4.0 Medium
- microsoft officehxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection...4.3 Medium
- novell suse lifecycle management serverSUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the...4.6 Medium
- siemens comosSiemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local...6.9 Medium
- cisco cloud portalCisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct...5.0 Medium
- emc rsa netwitness nextgen, rsa security analytics +1 moreEMC RSA Security Analytics (SA) 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure...6.8 Medium
- redhat libvirtvirt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files...7.2 High
- linux kernelThe fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly...4.7 Medium
- linux kernelThe perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before...3.6 Low
- debian adequateDebian adequate before 0.8.1, when run by root with the --user option, allows local users to...6.2 Medium
- steven jones contextThe json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before...4.9 Medium
- Show moreLoading…