CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- monkey-project monkeyThe Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers...5.8 Medium
- seamons net-serverNet-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves...4.3 Medium
- daiki ueno libfeplibfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace,...4.6 Medium
- fedoraproject sssd, redhat enterprise linux +1 moreThe System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership...3.3 Low
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11...7.5 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11...7.5 High
- microsoft xml core servicesMicrosoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script...6.8 Medium
- offis dcmtk(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc...7.2 High
- cisco webex meetings serverCisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote...4.0 Medium
- sap netweaverThe System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify...7.5 High
- rik de boer revisioningThe Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access...4.0 Medium
- mambo-foundation mambo cmsMambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to...2.1 Low
- autocomplete widgets project widgetsThe autocomplete callback in Autocomplete Widgets for Text and Number Fields ...4.0 Medium
- ibm spss modelerIBM SPSS Modeler 16.0 before 16.0.0.1 on UNIX does not properly drop group privileges, which...3.6 Low
- ibm security appscan sourceIBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not...4.3 Medium
- cisco webex meetings serverThe web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply...5.0 Medium
- cisco unified communications domain managerThe web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly...5.0 Medium
- cisco unified communications domain managerThe web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) does not properly...5.0 Medium
- emc documentum content serverEMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1...8.5 High
- condor project condorThe standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0...10.0 High
- xenXen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual...7.4 High
- radiothermostat ct50, ct80, ct50 firmware +1 more +3 moreRadio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the...8.3 High
- owncloud, owncloud server +1 moreownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote...4.0 Medium
- owncloudownCloud Server before 6.0.1 does not properly check permissions, which allows remote...4.0 Medium
- owncloud, owncloud server +1 moreownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which...4.0 Medium
- owncloud, owncloud server +1 moreThe document application in ownCloud Server before 6.0.3 uses sequential values for the file_id,...4.0 Medium
- owncloud, owncloud server +1 moreownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the...5.5 Medium
- owncloud, owncloud server +1 moreownCloud Server before 6.0.3 does not properly check permissions, which allows remote...7.5 High
- cisco unified communications domain managerThe web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and...4.0 Medium
- danielkorte nodeaccesskeysThe Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions...5.8 Medium
- openstack neutron, canonical ubuntu linux +1 moreThe default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not...7.6 High
- vmware vcenter server applianceRuby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users...9.0 High
- apache tomcatMissing XML Validation in Apache Tomcat4.3 Medium
- apache tomcatImproper Input Validation in Apache Tomcat4.3 Medium
- ibm db2The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5...8.5 High
- mate-desktop mate-settings-daemonThe default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone...2.1 Low
- cisco unified communications domain managerThe Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain...4.0 Medium
- cisco unified communications domain managerThe Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain...5.0 Medium
- jasig uportaluPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote...6.5 Medium
- jasig uportaluPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote...6.5 Medium
- redhat rhevm-reportsovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm...2.1 Low
- redhat rhevm-reportsThe Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses...2.1 Low
- google authenticator login project ga loginThe Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for...5.0 Medium
- redhat freeipaThe default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1)...5.0 Medium
- groups communities and co project gccThe Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly...5.0 Medium
- ibm tivoli storage flashcopy managerThe FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4...4.1 Medium
- ibm tivoli storage manager for virtual environmentsThe Data Protection for VMware component in IBM Tivoli Storage Manager for Virtual Environments ...4.1 Medium
- ibm maximo asset management, smartcloud control desk +1 moreIBM Maximo Asset Management 7.x before 7.5.0.3 IFIX027 and SmartCloud Control Desk 7.x before 7.5...6.0 Medium
- ibm change and configuration management database, maximo asset management, maximo service desk +4 more +6 moreIBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323...6.5 Medium
- Show moreLoading…