CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- canonical accountsservice, ubuntu linux +1 moreThe Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges...3.6 Low
- bzip bzip2The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not...4.6 Medium
- novell suse lifecycle management serverSUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which...2.1 Low
- paperthin commonspot content serverPaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended...7.5 High
- paperthin commonspot content serverPaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in...6.5 Medium
- paperthin commonspot content serverPaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended...7.5 High
- emc documentum content serverEMC Documentum Content Server before 6.7 SP1 P26, 6.7 SP2 before P13, 7.0 before P13, and 7.1...5.5 Medium
- kokuyo camiappThe Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows...5.8 Medium
- adobe readerThe Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of...9.3 High
- gopivotal grails, grails-resources +1 moreThe default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0...5.0 Medium
- gopivotal grails, grails-resources +1 moreThe default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0...5.0 Medium
- advanced package tool package toolThe pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0...4.3 Medium
- haxx curl, libcurl, apple mac os x +3 more +5 morecURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows...5.0 Medium
- citrix vdi-in-a-boxCitrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.3 allows local users to obtain...2.1 Low
- openstack compute, icehouse +1 moreOpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests6.0 Medium
- sophos web appliance, web appliance firmware +1 moreThe Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows...8.5 High
- erlang-solutions mongooseimErlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream7.8 High
- tigasenet/IOService.java in Tigase before 5.2.1 does not properly restrict the processing of compressed...7.8 High
- lightwitch metronomeplugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the...7.8 High
- isode m-linkIsode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements,...7.8 High
- igniterealtime openfireIgnite Realtime Openfire vulnerable to XMPPbomb attack7.8 High
- ibm business process managerThe User Attribute implementation in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8...6.0 Medium
- sap enhancement packageThe Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote...7.5 High
- sap enterprise portalSAP Enterprise Portal does not properly restrict access to the Federation configuration pages,...7.5 High
- sap netweaverAn unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict...7.5 High
- cisco adaptive security appliance softwareCisco Adaptive Security Appliance (ASA) Software 8.2 before 8.2(5.47), 8.4 before 8.4(7.5), 8.7...8.5 High
- wordpressWordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...4.0 Medium
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and...5.0 Medium
- tibco messaging appliance, rendezvous, substantiation es +2 moreThe Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd),...5.0 Medium
- prosodyProsody before 0.9.4 does not properly restrict the processing of compressed XML elements, which...7.8 High
- crowbar barclamp, novell suse cloud +1 moreBarclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not...7.5 High
- python pillow, pythonware python imaging library +1 morePillow Temporary file name leakage2.1 Low
- redhat jboss enterprise application platformRed Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager ...5.8 Medium
- zend framework, zendopenid +1 moreZendframework Local file disclosure via XXE injection in Zend_XmlRpc6.4 Medium
- openstack keystoneOpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend5.0 Medium
- redhat jboss operations networkRed Hat JBoss Operations Network (JON) before 3.0.1 uses 0777 permissions for the root directory...3.7 Low
- redhat jboss operations networkRed Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource"...3.5 Low
- chainfire supersuThe Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the...10.0 High
- google android, koushik dutta superuser +1 moreThe CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not...7.6 High
- redhat conga, enterprise linux +1 moreLuci in Red Hat Conga does not properly enforce the user session timeout, which might allow...3.7 Low
- mozilla firefoxThe saltProfileName function in base/GeckoProfileDirectories.java in Mozilla Firefox through 28.0...5.0 Medium
- zohocorp manageengine opstorProperties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege...6.5 Medium
- adobe acrobat readerAdobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via...10.0 High
- ibm data protection, flashcopy manager, tivoli storage flashcopy manager +1 more +3 moreThe (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM...2.1 Low
- apache xalan-java, oracle webcenter sites +1 moreImproper Authorization in Apache Xalan-Java7.5 High
- openstack computeOpenStack Nova VMWare driver leaks rescued images2.3 Low
- moodleMoodle attackers to modify grade metadata4.0 Medium
- moodleMoodle allows attackers to modify the visibility of a badge4.0 Medium
- moodleMoodle's time-validation implementation allows bypassing intended restrictions4.9 Medium
- moodleMoodle places a session key in a URL5.8 Medium
- Show moreLoading…