CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- emc documentum d2EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2...8.5 High
- emc rsa archer egrcEMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass...4.0 Medium
- canonical ubuntu linux, openstack image registry and delivery service \(glance\) +1 moreOpenStack Glance improper validation of the image_size_cap configuration option4.0 Medium
- redhat jboss enterprise application platformThe isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used...4.9 Medium
- redhat jboss enterprise application platformThe EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise...5.5 Medium
- blackberry os, q10, q5 +2 more +4 moreThe Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30...6.1 Medium
- ibm infosphere master data management, infosphere master data management server for product information management +1 moreIBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x...7.5 High
- ibm infosphere biginsightsIBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in...2.9 Low
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- adobe air, air sdk, flash player +2 moreAdobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11...10.0 High
- microsoft .net frameworkMicrosoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted...8.8 High
- microsoft sharepoint foundation, sharepoint server +1 moreMicrosoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow...9.3 High
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- hp nonstop safeguard securityHP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01...4.0 Medium
- ibm content collectorThe Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local...2.1 Low
- cisco nexus 9000, nx-os +1 moreCisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy...5.0 Medium
- cisco unity connectionThe server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to...9.0 High
- drupalmodules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to...6.8 Medium
- xbmcXBMC 13.0 uses world-readable permissions for .xbmc/userdata/sources.xml, which allows local...2.1 Low
- teampassTeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to...7.5 High
- teampassTeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language...7.5 High
- redhat enterprise virtualizationThe oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots...3.5 Low
- freelinking for case tracker project for case tracker, freelinking project freelinking +1 moreThe freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not...4.3 Medium
- codeaurora android-msmThe kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC)...7.2 High
- sap netweaver business warehouseThe SAP Netweaver Business Warehouse component does not properly restrict access to the functions...3.5 Low
- sap hana extended application servicesSAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions...5.0 Medium
- ibm embedded websphere application server, tivoli integrated portal +1 moreinstall.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli...6.9 Medium
- moodleMoodle does not enforce the moodle/site:accessallgroups capability requirement4.9 Medium
- moodleMoodle allows attackers to obtain username and course information5.0 Medium
- apple cups, canonical ubuntu linux +1 moreThe web interface in CUPS before 2.0 does not check that files have world-readable permissions,...5.0 Medium
- caucho resinThe ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode...5.0 Medium
- ui unifi videoThe default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video ...6.0 Medium
- eterna bozohttpd, netbsd +1 morebozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when...5.0 Medium
- siemens wincc, simatic pcs7 +1 moreSiemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain...4.6 Medium
- siemens wincc, simatic pcs7 +1 moreThe database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products,...6.0 Medium
- siemens wincc, simatic pcs7 +1 moreThe WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products,...4.9 Medium
- openstack neutronOpenStack Neutron allows remote authenticated users to cause a denial of service4.0 Medium
- mozilla firefox, oracle solaris +1 moreMozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof...5.8 Medium
- mozilla firefox, thunderbird +1 moreMozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox...5.8 Medium
- phpmyadmin, opensuse +1 moreserver_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote...4.0 Medium
- google chromeThe WebMediaPlayerAndroid::load function in content/renderer/media/android/webmediaplayer_android...7.5 High
- cybozu garoonCybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access...7.5 High
- Show moreLoading…