CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- moodleMoodle allows attackers to obtain sensitive information4.0 Medium
- moodleMoodle does not properly restrict access4.9 Medium
- moodleMoodle allows bypass of intended access restrictions4.9 Medium
- emc connectrix managerThe FileUploadController servlet in EMC Connectrix Manager Converged Network Edition (CMCNE)...5.0 Medium
- cisco content security management appliance, email security appliance firmware, ironport asyncos +2 moreThe End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security...8.5 High
- apache camelApache Camel's XSLT component allows remote attackers to execute arbitrary Java methods7.5 High
- apache camelApache Camel's XSLT component allows remote attackers to read arbitrary files7.5 High
- gplhost domain technologie controlThe install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for...7.5 High
- nttdocomo spmode mail androidThe application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for...4.3 Medium
- nttdocomo spmode mail androidThe NTT DOCOMO sp mode mail application 6300 and earlier for Android 4.0.x and 6700 and earlier...4.3 Medium
- mozilla firefox, seamonkey, opensuse +4 more +6 moreThe session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not...2.6 Low
- mozilla firefox, oracle solaris, suse linux enterprise desktop +2 more +4 moreMozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy...5.8 Medium
- blackberry qnx neutrino rtos/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain...4.9 Medium
- blackberry qnx neutrino rtos/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain...7.2 High
- openbsd openssh, oracle communications user data repository +1 moresshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config,...4.9 Medium
- owncloud, owncloud server +1 moreThe default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows...5.0 Medium
- owncloud, owncloud server +1 moreownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated...6.5 Medium
- owncloud, owncloud server +1 moreThe login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting...2.1 Low
- owncloud, owncloud server +1 moreapps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly...4.0 Medium
- owncloud, owncloud server +1 moreThe contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check...4.0 Medium
- rocklobster contact form 7Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection...5.0 Medium
- apple iphone osSpringboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended...5.8 Medium
- apple iphone os, tvos +1 moreThe Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass...5.8 Medium
- apple iphone osPhotos Backend in Apple iOS before 7.1 does not properly manage the asset-library cache during...1.9 Low
- apple tvosApple TV before 6.1 does not properly restrict logging, which allows local users to obtain...2.1 Low
- apple iphone osIOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring...5.0 Medium
- apple iphone osTelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user...5.0 Medium
- sambaThe owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4...5.8 Medium
- apple iphone osBackup in Apple iOS before 7.1 does not properly restrict symlinks, which allows remote attackers...8.8 High
- adobe flash playerAdobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and...6.4 Medium
- microsoft silverlightMicrosoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0...7.1 High
- microsoft windows server 2003, windows server 2008, windows server 2012 +2 more +4 moreThe Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2...5.4 Medium
- microsoft windows 7, windows 8, windows 8.1 +7 more +9 morewin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003...7.2 High
- linuxfoundation cups-filters, canonical ubuntu linux, debian linux +1 more +3 moreThe OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and...4.4 Medium
- plonePlone's authenticated users able to alter their password despite of policy definition4.0 Medium
- plonePlone is vulnerable to information exposure via the object manager implementation5.0 Medium
- plonePlone Unrestricted Filed Manipulation vulnerability via content edit forms4.3 Medium
- plonePlone is vulnerable to Information Exposure when generating zip archives5.8 Medium
- zte f460, f660 +1 moreweb_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain...10.0 High
- ibm aixftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for...6.5 Medium
- puppet enterprisePuppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console...5.0 Medium
- gnu gnutlsGnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats...5.8 Medium
- emc documentum taskspaceEMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 allows remote...4.0 Medium
- emc documentum taskspaceEMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle...8.5 High
- ibm algo oneIBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo...4.0 Medium
- google chromeThe PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc...5.8 Medium
- ibm websphere portalIBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7...4.3 Medium
- drinkedin barfinderThe DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used,...4.3 Medium
- edinburghtour edinburgh by busThe Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used,...6.8 Medium
- hsgroup forzearmateThe ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows...6.4 Medium
- Show moreLoading…