CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- theforeman foremanThe smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify...3.6 Low
- selinuxproject policycoreutilsseunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs...6.9 Medium
- apache strutsClassLoader manipulation in Apache Struts5.8 Medium
- broadcom symantec critical system protectionSymantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows...7.6 High
- xenThe HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to...6.7 Medium
- cisco nexus 1000v intercloudCisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to...5.0 Medium
- ayatana project unity, canonical ubuntu linux +1 moreUnity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which...4.4 Medium
- ayatana project unity, canonical ubuntu linux +1 moreUnity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when...4.4 Medium
- ayatana project unityUnity before 7.2.1 does not properly handle entry activation, which allows physically proximate...4.4 Medium
- amtelco misecuremessagesAMTELCO miSecure Information Exposure7.0
- xenXen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1...6.2 Medium
- sitepark information enterprise serverSitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier...6.8 Medium
- freebsdThe device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when...5.8 Medium
- fishshell fishfish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows...6.9 Medium
- plonePlone Privilege escalation through exposed underlying API5.5 Medium
- cisco telepresence tc software, telepresence te software +1 moreCisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict...7.2 High
- cybozu garoonCybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access...6.0 Medium
- php-fusionPHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted...5.0 Medium
- sap netweaver java application serverSAP Netweaver Java Application Server does not properly restrict access, which allows remote...5.0 Medium
- sap background processingSAP Background Processing does not properly restrict access, which allows remote authenticated...4.0 Medium
- sap profile maintenanceSAP Profile Maintenance does not properly restrict access, which allows remote authenticated...4.0 Medium
- sap netweaver abap application serverThe ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP...4.6 Medium
- fortinet fortiwebFortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via...6.5 Medium
- fortinet fortiauthenticatorFortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the...9.0 High
- canonical ubuntu linuxThe Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10...4.6 Medium
- gnome gnome-shellThe automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not...4.6 Medium
- organic groups project groupsThe Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated...4.9 Medium
- entity reference project entityreferenceThe Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read...4.3 Medium
- organic groups project groupsThe Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to...5.8 Medium
- invitation project invitationThe Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote...5.0 Medium
- apache strutsClassLoader manipulation in Apache Struts7.5 High
- apache strutsClassLoader manipulation in Apache Struts7.5 High
- livetecs timelineLivetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which...7.5 High
- super project supersuper.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag...7.2 High
- openstack neutron, canonical ubuntu linux, opensuse +2 moreThe openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014...9.0 High
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and...10.0 High
- tinymceThe bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the ...4.3 Medium
- xenXen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features,...5.5 Medium
- cisco iosCisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in...5.0 Medium
- apple mac os xPower Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to...3.3 Low
- apple mac os xWindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed...10.0 High
- apple iphone os, mac os x, mac os x server +1 more +3 moreCFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does...4.3 Medium
- cisco catalyst 6500, ios, catalyst 7600 +2 moreThe ACL implementation in Cisco IOS before 15.1(1)SY on Catalyst 6500 and 7600 devices allows...4.6 Medium
- djangoproject django, canonical ubuntu linux +1 moreDjango Reuses Cached CSRF Token5.0 Medium
- automattic jetpackThe Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before...5.8 Medium
- phpfoxstatic/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass...5.5 Medium
- phpfoxPHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me"...5.5 Medium
- sap routerThe passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier...4.3 Medium
- redhat openstackPackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to...6.4 Medium
- packagekit project packagekitThe Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages...2.1 Low
- Show moreLoading…