CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- symantec encryption management serverThe Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal...4.0 Medium
- apache commons fileupload, tomcat, oracle retail applications +2 moreCommons FileUpload Denial of service vulnerability7.5 High
- emc documentum foundation servicesThe web service in EMC Documentum Foundation Services (DFS) 6.5 through 6.7 before 6.7 SP1 P22, 6...9.0 High
- opensuse osc, opensuse +1 moreosc before 0.134 might allow remote OBS repository servers or package maintainers to execute...4.3 Medium
- mozilla firefox, canonical ubuntu linux, opensuse +4 more +6 moreMozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on...4.3 Medium
- systemtapSystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows...5.4 Medium
- cisco unified communications managerCisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local...6.0 Medium
- redhat jboss enterprise application platform, red hat jboss enterprise application platform 5 for rhel 6, jboss enterprise application platform 7 +2 more +4 moreJboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions5.5 Medium
- craig drummond cantataCantata before 1.2.2 does not restrict access to files in the play queue, which allows remote...5.0 Medium
- ibm financial transaction managerThe OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly...5.5 Medium
- ibm sametimeThe Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly...5.0 Medium
- civicrmCiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access...4.9 Medium
- courion access risk management suiteThe password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows...6.5 Medium
- cisco webex meetings serverCisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and ...4.9 Medium
- ibm tivoli application dependency discovery managerThe BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2...7.5 High
- xenThe do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not...8.3 High
- checkpoint management server, security gateway +1 moreCheck Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing...4.0 Medium
- galen charlton marc-xmlXML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used...5.0 Medium
- franklinfueling ts-550 evo, ts-550 evo firmware +1 morecgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other...5.0 Medium
- secunia csi agentSecunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when...3.6 Low
- cisco secure access control systemThe portal interface in Cisco Secure Access Control System (ACS) does not properly manage...5.5 Medium
- pocoo jinja2Incorrect Privilege Assignment in Jinja24.4 Medium
- detlef pilzecker proc\The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a...7.2 High
- redhat libvirtlibvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and...4.3 Medium
- redhat libvirtThe libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt...5.2 Medium
- redhat enterprise virtualization managerThe remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a...4.3 Medium
- openstack novaOpenStack Nova live snapshots use an insecure local directory3.3 Low
- ibm tivoli storage managerThe client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve...2.1 Low
- redhat jboss seam 2 frameworkThe InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier...5.0 Medium
- augeasThe transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly...4.6 Medium
- cisco nx-osCisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of...6.8 Medium
- cisco mediasenseThe Search and Play interface in Cisco MediaSense does not properly enforce authorization...4.0 Medium
- cisco asr 5000 series softwareThe Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on...5.0 Medium
- openstack python-keystoneclientpython-keystoneclient missing expiration check in PKI token validation5.5 Medium
- plonePlone Open Redirection vulnerability via next parameter5.8 Medium
- wordpresswp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly...4.0 Medium
- wordpresswp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive...6.4 Medium
- wordpresswp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability...4.0 Medium
- wordpressWordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site...2.1 Low
- wordpresswp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used,...4.9 Medium
- wordpresswp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and...5.8 Medium
- moodlecourse/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x...5.5 Medium
- drupalThe Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal,...4.0 Medium
- linux kernelThe restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel...4.7 Medium
- cisco secure access control systemThe RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce...6.3 Medium
- cisco secure access control systemThe RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly...9.0 High
- cisco secure access control systemThe RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly...10.0 High
- wellintech kinggraphic, kingscada, kingalarm\&event +2 moreWellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2...6.4 Medium
- cisco identity services engine softwareThe RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify...4.0 Medium
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac...10.0 High
- Show moreLoading…