CWE-264 (page 13)
Page 13 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-0266 | High | 7.1 | 2016-04-11 | The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs. |
CVE-2016-3065 | Critical | 9.1 | 2016-04-11 | The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass int… |
CVE-2016-1235 | High | 8.8 | 2016-04-11 | The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors re… |
CVE-2016-2393 | High | 7.8 | 2016-04-11 | Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local use… |
CVE-2016-2171 | High | 7.5 | 2016-04-11 | The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (… |
CVE-2016-3188 | High | 7.3 | 2016-04-08 | The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) conta… |
CVE-2016-3187 | High | 7.3 | 2016-04-08 | The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified imp… |
CVE-2016-1531 | High | 7.0 | 2016-04-07 | Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. |
CVE-2016-0788 | Critical | 9.8 | 2016-04-07 | The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener. |
CVE-2016-1313 | Critical | 9.8 | 2016-04-06 | Cisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance, and Whiptail Racerunner improperly store a default SSH priva… |
CVE-2016-1290 | High | 8.1 | 2016-04-06 | The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to b… |
CVE-2016-2288 | High | 7.8 | 2016-03-29 | Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file. |
CVE-2016-1366 | Medium | 6.5 | 2016-03-24 | The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows rem… |
CVE-2016-1773 | Low | 3.3 | 2016-03-24 | The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitra… |
CVE-2016-1751 | High | 7.8 | 2016-03-24 | The kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly restrict the execute permission, which allows attackers to bypass… |
CVE-2016-1734 | Medium | 6.8 | 2016-03-24 | AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or c… |
CVE-2015-7454 | Medium | 4.3 | 2016-03-21 | Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5… |
CVE-2016-2281 | High | 7.2 | 2016-03-18 | Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
CVE-2015-8154 | High | 8.8 | 2016-03-18 | The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows re… |
CVE-2014-9768 | High | 8.8 | 2016-03-18 | IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to t… |
CVE-2016-1990 | High | 7.8 | 2016-03-16 | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain priv… |
CVE-2016-2856 | High | 8.4 | 2016-03-14 | pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8… |
CVE-2016-1963 | High | 7.4 | 2016-03-13 | The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file d… |
CVE-2016-1954 | High | 8.8 | 2016-03-13 | The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of… |
CVE-2016-0832 | Medium | 6.1 | 2016-03-12 | Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection m… |
CVE-2016-0826 | High | 7.8 | 2016-03-12 | libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dum… |
CVE-2016-0822 | High | 7.0 | 2016-03-12 | The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_la… |
CVE-2016-0820 | High | 7.8 | 2016-03-12 | The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 26267358. |
CVE-2016-0819 | High | 7.8 | 2016-03-12 | The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a cr… |
CVE-2015-7411 | Critical | 9.9 | 2016-03-12 | The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileg… |
CVE-2016-0133 | Medium | 6.8 | 2016-03-09 | The USB Mass Storage Class driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… |
CVE-2016-0100 | High | 8.4 | 2016-03-09 | Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library… |
CVE-2016-0096 | High | 7.8 | 2016-03-09 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2016-0095 | High | 7.8 | 2016-03-09 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2016-0094 | High | 7.8 | 2016-03-09 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2016-0093 | High | 7.8 | 2016-03-09 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows… |
CVE-2016-0087 | High | 7.8 | 2016-03-09 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privilege… |
CVE-2016-0057 | High | 7.8 | 2016-03-09 | Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Tr… |
CVE-2016-1636 | Critical | 9.8 | 2016-03-06 | The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information… |
CVE-2016-1632 | High | 8.8 | 2016-03-06 | The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended acces… |
CVE-2016-1631 | High | 8.8 | 2016-03-06 | The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49… |
CVE-2016-1630 | High | 8.8 | 2016-03-06 | The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles wi… |
CVE-2015-7455 | Low | 3.1 | 2016-02-29 | IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows r… |
CVE-2016-2521 | High | 7.8 | 2016-02-28 | Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2… |
CVE-2016-0763 | Medium | 6.3 | 2016-02-25 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M… |
CVE-2016-0714 | High | 8.8 | 2016-02-25 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session att… |
CVE-2016-1341 | Critical | 9.8 | 2016-02-24 | Cisco NX-OS 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) on Nexus 2000 Fabric Extender devices has a blank root password, which allows local users to gain privile… |
CVE-2016-0724 | Medium | 4.3 | 2016-02-22 | The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2… |
CVE-2015-5342 | Medium | 4.3 | 2016-02-22 | The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intende… |
CVE-2015-5341 | Medium | 4.3 | 2016-02-22 | mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenti… |
CVE-2015-5340 | Medium | 4.3 | 2016-02-22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows… |
CVE-2015-5339 | Medium | 4.3 | 2016-02-22 | The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9… |
CVE-2015-5272 | Medium | 4.3 | 2016-02-22 | The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by… |
CVE-2015-5268 | Medium | 4.3 | 2016-02-22 | The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, whi… |
CVE-2015-5266 | Medium | 6.8 | 2016-02-22 | The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote… |
CVE-2015-5265 | Medium | 4.3 | 2016-02-22 | The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capabil… |
CVE-2015-5264 | Medium | 5.4 | 2016-02-22 | The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intende… |
CVE-2015-3273 | Medium | 4.3 | 2016-02-22 | mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" act… |
CVE-2016-1629 | Critical | 9.8 | 2016-02-21 | Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors. |
CVE-2015-7425 | Critical | 10.0 | 2016-02-21 | The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protec… |
CVE-2016-1335 | High | 7.5 | 2016-02-19 | The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication… |
CVE-2016-0069 | High | 8.8 | 2016-02-18 | Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of… |
CVE-2016-0068 | High | 8.8 | 2016-02-18 | Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of… |
CVE-2015-8150 | High | 7.8 | 2016-02-18 | Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file. |
CVE-2016-2071 | Critical | 9.8 | 2016-02-17 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Buil… |
CVE-2016-0766 | High | 8.8 | 2016-02-17 | PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified… |
CVE-2016-1152 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified ve… |
CVE-2015-8486 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified ve… |
CVE-2015-8485 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified v… |
CVE-2015-8484 | Medium | 5.4 | 2016-02-17 | Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vuln… |
CVE-2015-7408 | Low | 3.7 | 2016-02-15 | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAM… |
CVE-2016-1627 | High | 8.8 | 2016-02-14 | The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is as… |
CVE-2016-1625 | Medium | 4.3 | 2016-02-14 | The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggesti… |
CVE-2016-1623 | High | 8.8 | 2016-02-14 | The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach ope… |
CVE-2016-1622 | High | 8.8 | 2016-02-14 | The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior… |
CVE-2016-1949 | High | 8.8 | 2016-02-13 | Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same… |
CVE-2016-1324 | Medium | 5.3 | 2016-02-12 | The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service (resource outage) by accessing an administrative page, aka Bug I… |
CVE-2016-1322 | High | 7.5 | 2016-02-12 | The REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access restrictions and create arbitrary user accounts via unspecified… |
CVE-2016-1320 | Medium | 6.7 | 2016-02-12 | The CLI in Cisco Prime Collaboration 9.0 and 11.0 allows local users to execute arbitrary OS commands as root by leveraging administrator privileges, aka Bug I… |
CVE-2016-0051 | High | 7.8 | 2016-02-10 | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8… |
CVE-2016-0048 | High | 7.8 | 2016-02-10 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-0036 | High | 8.1 | 2016-02-10 | The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote authent… |
CVE-2015-8709 | High | 7.0 | 2016-02-08 | kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace… |
CVE-2016-0813 | Medium | 6.1 | 2016-02-07 | packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-0… |
CVE-2016-0812 | Medium | 6.1 | 2016-02-07 | The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1… |
CVE-2016-0810 | High | 7.8 | 2016-02-07 | media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, wh… |
CVE-2016-0809 | High | 8.8 | 2016-02-07 | Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain pr… |
CVE-2016-0807 | High | 8.4 | 2016-02-07 | The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mis… |
CVE-2016-0806 | High | 8.4 | 2016-02-07 | The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via… |
CVE-2016-0805 | High | 8.4 | 2016-02-07 | The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to g… |
CVE-2016-1906 | Critical | 9.8 | 2016-02-03 | Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed. |
CVE-2015-8748 | Medium | 5.3 | 2016-02-03 | Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrat… |
CVE-2016-1896 | Critical | 9.8 | 2016-01-27 | Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before Y… |
CVE-2016-1233 | High | 7.8 | 2016-01-26 | An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable… |
CVE-2015-7469 | Medium | 4.3 | 2016-01-17 | Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated… |
CVE-2015-7468 | Medium | 4.3 | 2016-01-17 | Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated… |
CVE-2016-1909 | Critical | 9.8 | 2016-01-15 | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4… |
CVE-2016-0852 | High | 7.5 | 2016-01-15 | Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vector… |
CVE-2015-8279 | High | 8.6 | 2016-01-15 | Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script. |
CVE-2015-6423 | Medium | 4.3 | 2016-01-15 | The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an int… |