CWE-264 (page 5)
Page 5 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-0073 | Critical | 9.8 | 2017-10-30 | The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser… |
CVE-2015-5699 | High | 7.8 | 2017-10-22 | The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharact… |
CVE-2017-12251 | Critical | 9.9 | 2017-10-19 | A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an authenticated, remote attacker to interact maliciously with t… |
CVE-2015-4650 | Critical | 9.8 | 2017-10-16 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root p… |
CVE-2015-3229 | Medium | 5.9 | 2017-10-16 | fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic upda… |
CVE-2014-7851 | High | 7.5 | 2017-10-16 | oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of ano… |
CVE-2015-5675 | High | 7.8 | 2017-10-10 | The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic). |
CVE-2015-2673 | High | 8.8 | 2017-10-06 | The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for Wo… |
CVE-2015-0296 | Medium | 4.7 | 2017-10-06 | The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to d… |
CVE-2017-12268 | Medium | 6.5 | 2017-10-05 | A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple… |
CVE-2017-12266 | Medium | 4.2 | 2017-10-05 | A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file wit… |
CVE-2015-7359 | High | 7.8 | 2017-10-03 | The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Wind… |
CVE-2015-7358 | High | 7.8 | 2017-10-03 | The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly vali… |
CVE-2015-3321 | Medium | 6.7 | 2017-10-03 | Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges vi… |
CVE-2017-12239 | Medium | 6.8 | 2017-09-29 | A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Broadband Routers c… |
CVE-2017-12230 | High | 8.8 | 2017-09-29 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an a… |
CVE-2017-12226 | High | 8.8 | 2017-09-29 | A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engi… |
CVE-2015-3643 | High | 7.8 | 2017-09-28 | usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2… |
CVE-2014-8156 | High | 7.8 | 2017-09-26 | The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged… |
CVE-2016-5868 | High | 7.0 | 2017-09-25 | drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application c… |
CVE-2015-7317 | Medium | 6.8 | 2017-09-25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. |
CVE-2017-12214 | High | 8.8 | 2017-09-21 | A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal… |
CVE-2015-0162 | High | 7.0 | 2017-09-20 | IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges. |
CVE-2015-4685 | High | 7.0 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/… |
CVE-2015-4683 | Critical | 9.8 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use… |
CVE-2014-9610 | Medium | 5.3 | 2017-09-19 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quaranti… |
CVE-2015-4523 | Critical | 9.3 | 2017-09-11 | Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism and con… |
CVE-2015-4629 | Critical | 9.8 | 2017-09-07 | Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other… |
CVE-2015-3222 | High | 7.0 | 2017-09-07 | syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root. |
CVE-2015-1590 | High | 7.8 | 2017-09-07 | The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. |
CVE-2013-7432 | High | 7.5 | 2017-08-29 | The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism. |
CVE-2016-2959 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804. |
CVE-2014-8428 | Critical | 9.8 | 2017-08-28 | Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. |
CVE-2015-1324 | High | 7.8 | 2017-08-25 | Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubun… |
CVE-2015-3617 | High | 7.8 | 2017-08-22 | Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands. |
CVE-2015-4082 | Medium | 6.5 | 2017-08-18 | attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository… |
CVE-2015-1878 | Medium | 6.8 | 2017-08-18 | Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with p… |
CVE-2016-5867 | High | 7.0 | 2017-08-16 | In a sound driver in Android for MSM, Firefox OS for MSM, QRD Android, some variables are from userspace and values can be chosen that could result in stack ov… |
CVE-2016-5864 | High | 7.8 | 2017-08-16 | In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from userspace, and if they… |
CVE-2016-5863 | High | 7.8 | 2017-08-16 | In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing which can lead to out-… |
CVE-2016-5862 | High | 7.0 | 2017-08-16 | When a control related to codec is issued from userspace in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, the type casting is… |
CVE-2016-5861 | High | 8.8 | 2017-08-16 | In a display driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable controlled by userspace is used to calculate… |
CVE-2016-5860 | High | 7.0 | 2017-08-16 | In an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an inte… |
CVE-2016-5859 | High | 7.0 | 2017-08-16 | In a sound driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integ… |
CVE-2016-5853 | High | 7.0 | 2017-08-16 | In an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel, when a sanity check encounters a length value not in the cor… |
CVE-2015-4165 | High | 7.5 | 2017-08-09 | The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessib… |
CVE-2015-5244 | Critical | 9.8 | 2017-08-07 | The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions. |
CVE-2015-8621 | Medium | 5.5 | 2017-08-07 | t-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally. |
CVE-2015-7875 | High | 7.5 | 2017-08-07 | ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panel… |
CVE-2015-7561 | Low | 3.1 | 2017-08-07 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. |
CVE-2015-1378 | High | 7.5 | 2017-08-07 | cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by… |
CVE-2014-9262 | High | 8.2 | 2017-08-07 | The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files. |
CVE-2017-7916 | Medium | 6.5 | 2017-08-07 | A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for R… |
CVE-2015-2560 | Critical | 9.8 | 2017-08-02 | Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser oper… |
CVE-2016-7845 | Medium | 6.5 | 2017-08-02 | GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file shari… |
CVE-2016-10398 | Medium | 6.2 | 2017-07-17 | Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens (AuthTokens) used by the Trusted Exec… |
CVE-2017-6713 | Critical | 9.8 | 2017-07-06 | A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the aff… |
CVE-2016-3998 | High | 8.1 | 2017-07-03 | NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors… |
CVE-2015-1795 | High | 7.8 | 2017-06-27 | Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root. |
CVE-2015-1591 | High | 7.8 | 2017-06-27 | The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. |
CVE-2004-2778 | High | 7.1 | 2017-06-27 | Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricte… |
CVE-2016-9972 | Medium | 5.9 | 2017-06-27 | IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-8493 | High | 8.8 | 2017-06-26 | In FortiClientWindows 5.4.1 and 5.4.2, an attacker may escalate privilege via a FortiClientNamedPipe vulnerability. |
CVE-2016-10364 | Medium | 6.5 | 2017-06-16 | With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authentica… |
CVE-2016-10341 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended. |
CVE-2016-9984 | High | 8.8 | 2017-06-13 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force I… |
CVE-2015-4596 | High | 7.8 | 2017-06-13 | Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges. |
CVE-2016-7818 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 a… |
CVE-2016-4471 | High | 8.8 | 2017-06-08 | ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code. |
CVE-2017-6640 | Critical | 9.8 | 2017-06-08 | A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative cons… |
CVE-2017-6638 | High | 7.8 | 2017-06-08 | A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install an… |
CVE-2016-3051 | Medium | 4.3 | 2017-06-07 | IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-Force ID: 114714. |
CVE-2016-8228 | High | 7.8 | 2017-06-04 | In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges. |
CVE-2016-5007 | High | 7.5 | 2017-05-25 | Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping req… |
CVE-2016-4435 | Critical | 9.0 | 2017-05-25 | An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write… |
CVE-2016-3084 | High | 8.1 | 2017-05-25 | The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA rele… |
CVE-2016-1876 | High | 7.8 | 2017-05-23 | The backend service process in Lenovo Solution Center (aka LSC) before 3.3.0002 allows local users to gain SYSTEM privileges via unspecified vectors. |
CVE-2015-8089 | High | 7.8 | 2017-05-23 | The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users t… |
CVE-2015-5682 | High | 7.5 | 2017-05-23 | upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir varia… |
CVE-2015-4045 | Medium | 6.7 | 2017-05-23 | The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script. |
CVE-2016-6112 | High | 8.8 | 2017-05-22 | IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative… |
CVE-2017-6637 | Medium | 6.5 | 2017-05-22 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker t… |
CVE-2017-6635 | Medium | 6.5 | 2017-05-22 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker t… |
CVE-2017-6623 | High | 7.8 | 2017-05-18 | A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could allow an authentic… |
CVE-2017-6622 | Critical | 9.8 | 2017-05-18 | A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and pe… |
CVE-2016-10372 | Critical | 9.8 | 2017-05-16 | The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstra… |
CVE-2016-10238 | High | 7.8 | 2017-05-16 | In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue. |
CVE-2016-5979 | Low | 2.7 | 2017-05-15 | IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with security profile not vali… |
CVE-2016-10291 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10290 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm shared memory driver could enable a local malicious application to execute arbitrary code within the co… |
CVE-2016-10289 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-10288 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-10287 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10286 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10285 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10284 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10283 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10282 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10281 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10280 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |