CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- apple mac os xApp Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism...7.5 High
- sybase adaptive server enterpriseSAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3...6.5 Medium
- jenkinsJenkins allows attackers to obtain sensitive information3.5 Low
- jenkinsJenkins allows attackers to execute arbitrary jobs6.5 Medium
- jenkinsJenkins allows attackers to configure restricted projects4.0 Medium
- jenkins, redhat openshift +1 moreJenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs6.0 Medium
- microsoft windows, twiki +1 morelib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection...4.3 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...6.8 Medium
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...8.8 High
- microsoft .net frameworkMicrosoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which...4.3 Medium
- microsoft win32k, windows 7, windows 8 +7 more +9 morewin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft .net frameworkMicrosoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data...10.0 High
- adobe coldfusionAdobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before...4.6 Medium
- mozilla firefoxMultiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow...7.5 High
- cryoserver security applianceCryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which...6.8 Medium
- x2engineFileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file...5.0 Medium
- hp network automationUnspecified vulnerability in HP Network Automation 9.10 and 9.20 allows local users to bypass...7.2 High
- mozilla bugzilla, fedoraproject fedora +1 moreThe confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x...5.0 Medium
- adaptivecomputing torque resource managerThe tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka...6.8 Medium
- joomla joomla\!Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and...7.5 High
- google chromebase/memory/shared_memory_win.cc in Google Chrome before 38.0.2125.101 on Windows does not...7.5 High
- google chrome, redhat enterprise linux desktop supplementary, enterprise linux server supplementary +2 more +4 moreThe chrome_pdf::CopyImage function in pdf/draw_utils.cc in the PDFium component in Google Chrome...7.5 High
- google chrome, redhat enterprise linux desktop supplementary, enterprise linux server supplementary +2 more +4 moreThe NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in...5.0 Medium
- golang gocrpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the...4.3 Medium
- openstack neutronThe default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014...7.6 High
- brocade vyatta 5400 vrouter, vyatta 5400 vrouter software +1 moreThe Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive...5.0 Medium
- ibm business process managerThe Saved Search Admin component in the Process Admin Console in IBM Business Process Manager ...4.0 Medium
- redhat cloudforms 3.0.1 management engine, cloudforms 3.0.2 management engine, cloudforms 3.0.3 management engine +3 more +5 morevmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management...6.5 Medium
- redhat congaThe component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows...5.5 Medium
- redhat cloudforms 3.0.1 management engine, cloudforms 3.0.2 management engine, cloudforms 3.0.3 management engine +3 more +5 moreRed Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to...4.0 Medium
- cisco ios xr, asr 9000 rsp440 router, asr 9001 +5 more +7 moreCisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address...7.5 High
- daniel lienert yet another gallery, michael knoll tools for extbase developmen +1 moreyag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions7.5 High
- alex kellner powermailTYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism7.5 High
- openstack neutron, canonical ubuntu linux +1 moreOpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to...4.0 Medium
- ibm websphere mqIBM WebSphere MQ 8.x before 8.0.0.1 does not properly enforce CHLAUTH rules for blocking client...6.5 Medium
- redhat hibernate validatorImproper Authentication in Hibernate Validator5.0 Medium
- plonePlone Arbitrary File Read5.0 Medium
- plonePlone denial of service via Caching Bypass5.0 Medium
- plone, zope +1 morePlone and Zope2 vulnerable to unauthorized access to restricted attributes6.5 Medium
- plonePlone Sandbox Bypass8.5 High
- openmediavaultThe Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron...9.0 High
- linksys ea6500, ea6500 firmware +1 moreLinksys EA6500 with firmware 1.1.28.147876 does not properly restrict access, which allows remote...7.1 High
- bcron project execbcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files...2.1 Low
- juniper junos pulse client, installer service client +1 moreJuniper Installer Service (JIS) Client 7.x before 7.4R6 for Windows and Junos Pulse Client before...7.2 High
- jig jigbrowser\+The jigbrowser+ application 1.8.1 and earlier for iOS allows remote attackers to bypass the Same...5.8 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 morearch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag...1.9 Low
- linux kernel, xen, ubuntu +2 moreXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to...4.9 Medium
- linux kernelThe stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses...5.0 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 moreThe InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat...6.9 Medium
- Show moreLoading…