CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- adobe phonegap, apache cordova +1 moreApache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do...7.5 High
- adobe phonegapAdobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the...7.5 High
- adobe phonegap, apache cordova +1 moreApache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to...7.5 High
- adobe phonegap, apache cordova +1 moreApache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to...7.5 High
- google android apiThe Android API before 17 does not properly restrict the WebView.addJavascriptInterface method,...6.8 Medium
- bluecoat proxysgosThe caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2...7.9 High
- ibm content navigatorIBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to bypass...3.5 Low
- cisco unified contact center express editor softwareCisco Unified Contact Center Express (Unified CCX) does not properly restrict the content of the...4.0 Medium
- apple mac os x, mac os x server +1 moreThe systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local...4.6 Medium
- apple mac os xFinder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL...3.3 Low
- apple mac os xCFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action...3.6 Low
- cybozu garoonCybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which...4.9 Medium
- norman security suiteUnspecified vulnerability in Norman Security Suite 10.1 and earlier allows local users to gain...7.2 High
- mcafee epolicy orchestratorThe Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148...6.3 Medium
- ibm netezza performance portalIBM Netezza Performance Portal 2.x before 2.0.0.3 allows remote authenticated users to change...4.0 Medium
- ibm rational focal pointIBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote...4.0 Medium
- google chromeThe drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict...5.0 Medium
- google chromecore/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0...6.4 Medium
- ibm cognos business intelligenceThe server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10...5.0 Medium
- cisco unified communications managerThe administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and...5.0 Medium
- cisco unified sip phone 3905The Cisco Unified SIP Phone 3905 with firmware before 9.4(1) allows remote attackers to obtain...10.0 High
- cisco ips sensor softwareThe control-plane access-list implementation in Cisco IPS Software before 7.1(8p2)E4 and 7.2...7.8 High
- belkin wemo home automation firmwareThe Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN...9.3 High
- ibm websphere extreme scale clientIBM WebSphere eXtreme Scale Client 7.1 through 8.6.0.4 does not properly isolate the cached data...3.5 Low
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and...7.8 High
- postgresql, apple mac os x, mac os x server +2 moreThe "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly...4.6 Medium
- postgresqlThe validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x...6.5 Medium
- postgresqlPostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x...4.0 Medium
- apple iphone osThe iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an...4.6 Medium
- freepbxadmin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11...7.5 High
- ubuntu metal as a serviceUbuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml,...2.1 Low
- puppetPuppet does not properly restrict access to node resources5.5 Medium
- gnu gnutlslib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509...5.8 Medium
- qualcomm quic mobile station modem kernelThe CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm...9.3 High
- hp linux imaging and printing projectHP Linux Imaging and Printing (HPLIP) before 3.13.2 uses world-writable permissions for /var/log...2.1 Low
- linux-nfs nfs-utilsThe host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does...7.5 High
- ecryptfs ecryptfs-utils, utils +1 moreutils/ecryptfs-recover-private in ecryptfs-utils before 90 does not establish a subdirectory with...4.6 Medium
- apache tomcat** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its...2.1 Low
- sap netweaver, netweaver solution manager +1 moreThe Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote...5.0 Medium
- redhat jboss enterprise application platform, jboss wildfly application server +1 moreRed Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server,...1.9 Low
- ryan ohara piranhaThe Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages,...5.8 Medium
- ibm websphere dashboard frameworkThe charting component in IBM WebSphere Dashboard Framework (WDF) 6.1.5 and 7.0.1 allows remote...5.8 Medium
- ibm sametimeThe Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 do not have an...7.5 High
- ibm sametimeThe Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send...5.0 Medium
- microsoft .net frameworkVsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 through 11 does not properly restrict file installation and...4.3 Medium
- sophos anti-virus, scanning engine +1 moreSophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x...5.6 Medium
- nagiosstatus.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access...4.0 Medium
- xkeyboard config project xkeyboard-config, x x.org x11 +1 morexkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by...4.6 Medium
- libcapThe capsh program in libcap before 2.22 does not change the current working directory when the -...4.6 Medium
- Show moreLoading…