CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- cybozu garoonThe Portlets subsystem in Cybozu Garoon 2.x and 3.x before 3.7 SP4 allows remote authenticated...4.0 Medium
- drupalThe File module in Drupal 7.x before 7.29 does not properly check permissions to view files,...4.9 Medium
- google chrome, debian linux +1 moreThe ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in...6.8 Medium
- entity api project apiThe Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b)...5.0 Medium
- entity api project apiThe Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node...4.0 Medium
- ibm storwize unified v7000, storwize unified v7000 software +1 moreIBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to...6.5 Medium
- sonicwall scrutinizerDell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via...5.5 Medium
- zte zxv10 w300, zxv10 w300 firmware +1 moreZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web...5.0 Medium
- juniper junosJuniper Junos 11.4 before 11.4R12, 12.1 before 12.1R11, 12.1X44 before 12.1X44-D35, 12.1X45...9.0 High
- citrix xendesktopCitrix XenDesktop 7.x, 5.x, and 4.x, when pooled random desktop groups is enabled and...4.9 Medium
- docker, fedoraproject fedora +1 morePrivilege Escalation in Docker7.2 High
- cisco ios, ios xe +1 moreThe NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group...5.0 Medium
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11...7.5 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates,...6.4 Medium
- microsoft windows 7, windows 8, windows 8.1 +5 more +7 moreMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,...7.6 High
- microsoft windows 7, windows 8, windows 8.1 +3 more +5 moreDirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,...6.9 Medium
- avg safeguard, secure search toolbar +1 moreScriptHelperApi in the AVG ScriptHelper ActiveX control in ScriptHelper.exe in AVG Secure Search...9.3 High
- cisco unified cdm application software, unified communications domain manager +1 moreThe BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in...7.5 High
- cisco unified cdm application software, unified communications domain manager +1 moreThe Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM)...9.0 High
- ibm storwize unified v7000, storwize unified v7000 software +1 moreActive Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote...3.5 Low
- ibm infosphere biginsightsIBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended...3.5 Low
- cisco cloud portalCisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the...4.0 Medium
- ibm aix, vios +1 moreThe runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666...7.2 High
- ibm sametime meeting serverstconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format...5.5 Medium
- apple tvosApple TV before 6.1.2 allows remote authenticated users to bypass an intended password...5.5 Medium
- apple mac os xThunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API...10.0 High
- apple mac os xThe Security - Keychain component in Apple OS X before 10.9.4 does not properly implement...2.6 Low
- apple mac os xIOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection...2.1 Low
- apple mac os xIntel Compute in Apple OS X before 10.9.4 does not properly restrict an unspecified OpenCL API...10.0 High
- apple mac os xIntel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR...2.1 Low
- apple mac os xIntel Graphics Driver in Apple OS X before 10.9.4 does not properly restrict an unspecified...10.0 High
- apple mac os xGraphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during...4.9 Medium
- apple iphone osLock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane...3.6 Low
- apple iphone osLock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode...1.9 Low
- apple iphone osSiri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock...3.6 Low
- apple iphone osSettings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended...4.6 Medium
- ibm openpages grc platformUnspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote...6.4 Medium
- ctdb project ctdb, opensuse, mageia +2 morectdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has...7.5 High
- linux kernelarch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does...4.6 Medium
- linux kernelThe capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that...6.2 Medium
- symantec encryption desktop, pgp desktop +1 moreSymantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X...4.3 Medium
- ibm storwize unified v7000, storwize unified v7000 software +1 moreIBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly...4.0 Medium
- linuxfoundation cups-filterscups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access...4.0 Medium
- openstack neutron, canonical ubuntu linux +1 moreThe L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2...3.5 Low
- ppc64-diag project ppc64-diag, redhat enterprise linux server, suse linux enterprise server +2 moreppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict...2.1 Low
- canonical ubuntu linuxThe OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0...5.0 Medium
- cisco ios xeThe mDNS implementation in Cisco IOS XE 3.12S does not properly interact with autonomic...4.8 Medium
- ibm pureapplication systemIBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote...6.6 Medium
- sharetronixSharetronix 3.1.1.3, 3.1.1, and earlier does not properly restrict access to unspecified AJAX...7.5 High
- Show moreLoading…