CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, canonical ubuntu linux, opensuse +2 moreThe HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly...7.5 High
- mozilla firefox, canonical ubuntu linux, opensuse +2 moreThe HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly...7.5 High
- mozilla firefox, canonical ubuntu linux, opensuse +2 moreMozilla Firefox before 37.0 relies on docshell type information instead of page principal...5.0 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow...7.5 High
- xen, canonical ubuntu linux, debian linux +1 more +3 moreQEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command...4.9 Medium
- wpmlThe "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to...6.4 Medium
- openldap, debian linux +1 moreThe default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows...4.0 Medium
- emc isilon onefsThe RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1...7.2 High
- mcafee data loss prevention endpointThe ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9...6.5 Medium
- citrix command centerCitrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict...7.5 High
- solarwinds firewall security manageruserlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote...10.0 High
- ibm general parallel file systemIBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before...7.2 High
- mozilla firefox, firefox esr, seamonkey +2 moreMozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow...7.5 High
- php, apple mac os x, opensuse +6 more +8 moreThe move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5...5.0 Medium
- moodleMoodle allows attackers to bypass a forced-password-change requirement4.0 Medium
- moodleMoodle does not consider the moodle/tag:flag capability4.0 Medium
- ibm api managementThe developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access...5.5 Medium
- ibm content collectorIBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3...2.1 Low
- ibm rational collaborative lifecycle management, rational doors next generation, rational quality manager +2 more +4 moreIBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x...5.5 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement...6.6 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain...7.2 High
- scadaengine bacnet opc serverThe SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote...7.5 High
- microsoft internet explorerMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted...4.3 Medium
- microsoft windows 8, windows 8.1, windows rt +2 more +4 morewin32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012...7.2 High
- microsoft windows 7, windows server 2008, windows vista +1 more +3 moreThe kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and...7.2 High
- microsoft windows 7, windows 8, windows 8.1 +6 more +8 moreThe Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows...7.2 High
- xen, fedoraproject fedora +1 moreXen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM...1.9 Low
- xen, debian linux, fedoraproject fedora +2 moreThe x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for...7.2 High
- google chromeThe DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc...5.0 Medium
- google chromecontent/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0...5.0 Medium
- google chromecontent/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76...5.0 Medium
- siemens spcanywhereThe Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass...2.1 Low
- nvidia gpu driver r304, gpu driver r340, gpu driver r343 +1 more +3 moreThe NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346...7.2 High
- cisco secure access control systemCisco Secure Access Control Server (ACS) provides an unintentional administration web interface...6.5 Medium
- automount project automount, opensuse, redhat enterprise linux desktop +3 more +5 moreautomount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's...4.4 Medium
- sap businessobjects edgeSAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee...5.0 Medium
- mozilla firefox, canonical ubuntu linux, opensuse +2 moreMozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or...6.8 Medium
- google play services sdkThe GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in...4.3 Medium
- redhat kie workbenchThe default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to...6.5 Medium
- redhat uberfireUberFire Framework Improperly Restricts Paths6.8 Medium
- redhat jboss enterprise application platform, jboss enterprise brms platform +1 morePicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and...3.6 Low
- softsphere defensewall personal firewallThe dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write...7.2 High
- tibco activematrix management agent, activematrix policy agent, activematrix policy manager +2 moreThe ActiveMatrix Policy Manager Authentication module in TIBCO ActiveMatrix Policy Agent 3.x...6.4 Medium
- siemens simatic step 7Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of...4.4 Medium
- open-xchange appsuiteOpen-Xchange (OX) AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1...4.0 Medium
- cisco adaptive security appliance softwareCisco Adaptive Security Appliance (ASA) Software 9.2(.3) and earlier, when challenge-response...4.0 Medium
- ibm maximo asset management, smartcloud control desk, change and configuration management database +9 more +11 moreIBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX008, Maximo Asset...2.1 Low
- samsung security managerThe ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to...8.5 High
- persistent systems radia client automationPersistent Systems Radia Client Automation does not properly restrict access to certain request,...10.0 High
- motorola scanner sdkMotorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice...7.2 High
- Show moreLoading…