CWE-264 (page 46)
Page 46 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2009-1338 | | 2009-04-22 | The kill_something_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID… | |
CVE-2009-1337 | | 2009-04-22 | The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allo… | |
CVE-2008-6736 | | 2009-04-21 | Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachab… | |
CVE-2009-1322 | | 2009-04-17 | ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database… | |
CVE-2009-0579 | | 2009-04-16 | Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security po… | |
CVE-2009-0079 | | 2009-04-15 | The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that… | |
CVE-2009-0078 | | 2009-04-15 | The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does no… | |
CVE-2008-6701 | | 2009-04-10 | NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allow… | |
CVE-2009-1160 | | 2009-04-09 | Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9, and 8.0 before 8… | |
CVE-2008-6674 | | 2009-04-08 | mailPage.asp in QuickerSite 1.8.5 allows remote attackers to flood e-mail accounts with messages via a large number of requests with a modified sEmail paramete… | |
CVE-2008-6673 | | 2009-04-08 | asp/bs_login.asp in QuickerSite 1.8.5 does not properly restrict access to administrative functionality, which allows remote attackers to (1) change the admin… | |
CVE-2009-1264 | | 2009-04-07 | Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticate… | |
CVE-2008-6650 | | 2009-04-07 | del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_id parameter, a different vulnerability… | |
CVE-2008-6643 | | 2009-04-07 | LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to bypass intended res… | |
CVE-2008-6619 | | 2009-04-06 | Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitrary code by uploading a file with an ex… | |
CVE-2008-6617 | | 2009-04-06 | Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with… | |
CVE-2008-6613 | | 2009-04-06 | uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request. | |
CVE-2008-6603 | | 2009-04-03 | MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access re… | |
CVE-2008-6599 | | 2009-04-03 | cookiecheck.php in CookieCheck 1.0 stores tmp/cc_sessions under the web root with insufficient access control, which allows remote attackers to obtain session… | |
CVE-2009-1235 | | 2009-04-02 | XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allow… | |
CVE-2009-1226 | | 2009-04-02 | core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to dele… | |
CVE-2009-1223 | | 2009-04-02 | aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a datab… | |
CVE-2008-6580 | | 2009-04-02 | The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to d… | |
CVE-2003-1571 | | 2009-04-02 | Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2009-1214 | | 2009-04-01 | GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session inf… | |
CVE-2005-4880 | | 2009-03-31 | Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain IP address… | |
CVE-2009-1173 | | 2009-03-31 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attac… | |
CVE-2008-6540 | | 2009-03-30 | DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot… | |
CVE-2009-0637 | | 2009-03-27 | The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which all… | |
CVE-2008-6535 | | 2009-03-26 | admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request… | |
CVE-2009-1085 | | 2009-03-25 | Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key… | |
CVE-2009-1084 | | 2009-03-25 | Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated… | |
CVE-2009-1078 | | 2009-03-25 | Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies and (2) modifying w… | |
CVE-2009-1077 | | 2009-03-25 | The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge p… | |
CVE-2009-1053 | | 2009-03-24 | chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database… | |
CVE-2009-1052 | | 2009-03-24 | FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database… | |
CVE-2009-1051 | | 2009-03-24 | FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databa… | |
CVE-2008-6514 | | 2009-03-24 | The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse… | |
CVE-2008-6506 | | 2009-03-23 | Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors. | |
CVE-2008-6496 | | 2009-03-20 | Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX allows remote attack… | |
CVE-2008-6494 | | 2009-03-20 | ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via… | |
CVE-2008-6493 | | 2009-03-20 | Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote attackers to download… | |
CVE-2009-0941 | | 2009-03-18 | The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier f… | |
CVE-2009-0873 | | 2009-03-11 | The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, whi… | |
CVE-2009-0872 | | 2009-03-11 | The NFS server in Sun Solaris 10, and OpenSolaris before snv_111, does not properly implement the AUTH_NONE (aka sec=none) security mode in combination with ot… | |
CVE-2009-0866 | | 2009-03-10 | pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a dir… | |
CVE-2009-0835 | | 2009-03-06 | The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCO… | |
CVE-2009-0767 | | 2009-03-06 | Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing crede… | |
CVE-2009-0760 | | 2009-03-06 | Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database c… | |
CVE-2009-0828 | | 2009-03-05 | QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, includ… | |
CVE-2009-0827 | | 2009-03-05 | PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user cre… | |
CVE-2009-0826 | | 2009-03-05 | BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing use… | |
CVE-2008-6399 | | 2009-03-05 | Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors. | |
CVE-2009-0578 | | 2009-03-05 | GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or rem… | |
CVE-2009-0367 | | 2009-03-05 | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted mod… | |
CVE-2009-0365 | | 2009-03-05 | nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection password… | |
CVE-2009-0809 | | 2009-03-04 | The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated use… | |
CVE-2009-0807 | | 2009-03-04 | zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php. | |
CVE-2009-0806 | | 2009-03-04 | Unspecified vulnerability in OpenGoo before 1.2.1 allows remote authenticated users to modify their own permissions via unknown attack vectors. | |
CVE-2009-0804 | | 2009-03-04 | Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypa… | |
CVE-2009-0803 | | 2009-03-04 | SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HT… | |
CVE-2009-0802 | | 2009-03-04 | Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypas… | |
CVE-2009-0801 | | 2009-03-04 | Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass acces… | |
CVE-2008-6388 | | 2009-03-02 | Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the d… | |
CVE-2008-6382 | | 2009-03-02 | ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file… | |
CVE-2008-6375 | | 2009-03-02 | JBook stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direc… | |
CVE-2008-6374 | | 2009-03-02 | CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers t… | |
CVE-2008-6357 | | 2009-03-02 | MyCal Personal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a da… | |
CVE-2008-6356 | | 2009-03-02 | evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database co… | |
CVE-2008-6355 | | 2009-03-02 | The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a data… | |
CVE-2008-6354 | | 2009-03-02 | The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databas… | |
CVE-2009-0028 | | 2009-02-27 | The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child proces… | |
CVE-2008-6321 | | 2009-02-27 | CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information, s… | |
CVE-2008-6302 | | 2009-02-26 | TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to Site_Admin/admin.php. | |
CVE-2008-6296 | | 2009-02-26 | admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "demo." | |
CVE-2008-6294 | | 2009-02-26 | admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to… | |
CVE-2008-6293 | | 2009-02-26 | admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie to "admin… | |
CVE-2008-6292 | | 2009-02-26 | Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) username_cookie to "admin," (2) right_cookie t… | |
CVE-2008-6291 | | 2009-02-26 | Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to "admin". | |
CVE-2009-0732 | | 2009-02-24 | Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credentials and other sens… | |
CVE-2009-0439 | | 2009-02-24 | Unspecified vulnerability in the queue manager in IBM WebSphere MQ (WMQ) 5.3, 6.0 before 6.0.2.6, and 7.0 before 7.0.0.2 allows local users to gain privileges… | |
CVE-2007-5289 | | 2009-02-24 | HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the… | |
CVE-2009-0700 | | 2009-02-23 | Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modi… | |
CVE-2009-0676 | | 2009-02-22 | The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to… | |
CVE-2009-0675 | | 2009-02-22 | The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability… | |
CVE-2009-0641 | | 2009-02-20 | sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD… | |
CVE-2008-6199 | | 2009-02-20 | 2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via a direct request to backup.php, which… | |
CVE-2008-6160 | | 2009-02-18 | Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly implement menu and data… | |
CVE-2009-0613 | | 2009-02-17 | Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission s… | |
CVE-2008-6147 | | 2009-02-16 | ForumApp 3.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direc… | |
CVE-2008-6137 | | 2009-02-14 | EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors. | |
CVE-2008-6136 | | 2009-02-14 | Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unk… | |
CVE-2009-0571 | | 2009-02-13 | admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers… | |
CVE-2009-0361 | | 2009-02-13 | Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running… | |
CVE-2008-6125 | | 2009-02-13 | Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated users to gain privi… | |
CVE-2009-0014 | | 2009-02-13 | Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local user… | |
CVE-2009-0011 | | 2009-02-13 | Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a… | |
CVE-2009-0536 | | 2009-02-11 | at in bos.rte.cron on IBM AIX 5.2.0, 5.3.0 through 5.3.9, and 6.1.0 through 6.1.2 allows local users to read arbitrary files via unspecified vectors, related t… | |
CVE-2008-6109 | | 2009-02-11 | Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 does not properly enforce the privileges of user accounts, which allows local users to bypass int… | |
CVE-2009-0438 | | 2009-02-10 | IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information… |