CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- ibm maximo asset management, smartcloud control desk +1 moreIBM Maximo Asset Management 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5...6.0 Medium
- ibm maximo asset management, smartcloud control desk +1 moreIBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and...3.5 Low
- ibm sametimeThe Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check...4.3 Medium
- ibm sametimeThe Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote...5.0 Medium
- cisco nx-osCisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs...7.1 High
- cisco nexus 7000, nx-os, nexus 7000 10-slot +2 more +4 moreCisco NX-OS 6.1 before 6.1(5) on Nexus 7000 devices, when local authentication and multiple VDCs...7.1 High
- emc documentum d2EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2...9.0 High
- imember360The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access,...4.3 Medium
- imember360The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which...5.0 Medium
- gentoo nullmailerThe Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer...5.0 Medium
- citrix cloudplatformCitrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly...7.5 High
- modwsgi mod wsgiThe mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle...6.2 Medium
- canonical ubuntu linux, gdm-guest-session project gdm-guest-session +1 moregdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04...2.1 Low
- canonical ubuntu linux, robert ancell lightdm +1 moredebian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7...2.1 Low
- emerson deltavEmerson DeltaV Use of Improper Authorization6.2
- tinymce color pickerThe TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions,...5.0 Medium
- x2go serverx2gocleansessions in X2Go Server before 4.0.0.8 and 4.0.1.x before 4.0.1.10 allows remote...9.0 High
- typo3TYPO3 Improper Access Management in the File Abstraction Layer5.5 Medium
- moodleMoodle does not properly restrict file access5.0 Medium
- maharaMahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict...4.0 Medium
- maharaMahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access...5.5 Medium
- maharaMahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict...4.0 Medium
- quick tabs module project quicktabsThe Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6...5.0 Medium
- pocoo jinja2Insecure Temporary File in Jinja24.4 Medium
- apple itunesApple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared...4.4 Medium
- florian weber spacesThe Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly...2.1 Low
- skyboxsecurity skybox view appliance, skybox view appliance iso +1 moreSkybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2...8.5 High
- symantec workspace streamingThe server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to...7.9 High
- redhat cloudforms 3.0 management engineThe CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote...4.0 Medium
- katello installerKatello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello...2.1 Low
- microsoft officeThe MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and...6.8 Medium
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe ShellExecute API in Windows Shell in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- adobe acrobat, acrobat reader +1 moreThe API in Adobe Reader and Acrobat 10.x before 10.1.10 and 11.x before 11.0.07 on Windows and OS...10.0 High
- adobe air, flash player +1 moreAdobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe...7.5 High
- adobe air, flash player +1 moreAdobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe...7.5 High
- adobe air, flash player +1 moreAdobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe...7.5 High
- adobe air, flash player +1 moreAdobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe...7.5 High
- adobe air, flash player +1 moreAdobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe...7.5 High
- redhat icedtea-web, icedtea6 +1 moreThe Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and...6.8 Medium
- monster menus project menusThe Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node...2.6 Low
- nathan haug filefield sourcesThe FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does...4.0 Medium
- quiz module project quizThe default views in the Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote attackers to...5.0 Medium
- quiz module project quizThe Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote authenticated users with the ...4.9 Medium
- gnu grubA certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows...2.1 Low
- nlnetlabs ldnsThe ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private...2.1 Low
- theforeman foremanForeman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews,...5.0 Medium
- theforeman kafoKafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml1.9 Low
- gnu rushGNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files...4.9 Medium
- varnish cache project cachevarnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log...2.1 Low
- theforeman foremanForeman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest...6.5 Medium
- Show moreLoading…