CWE-264 (page 7)
Page 7 of 55 — CVEs classified under CWE-264, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10151 | High | 7.0 | 2017-03-01 | The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which al… |
CVE-2016-4043 | Medium | 4.9 | 2017-02-24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit tem… |
CVE-2016-4041 | High | 7.3 | 2017-02-24 | Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access… |
CVE-2016-9009 | Low | 3.1 | 2017-02-24 | IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #… |
CVE-2016-9315 | High | 8.8 | 2017-02-21 | Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) ve… |
CVE-2016-9269 | Critical | 9.9 | 2017-02-21 | Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linu… |
CVE-2016-7661 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "Power Management" com… |
CVE-2016-7660 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7628 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to byp… |
CVE-2016-7613 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS befor… |
CVE-2016-7583 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iCloud before 6.0.1 is affected. The issue involves the setup subsystem in the "iCloud" component. It allows… |
CVE-2016-7582 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Intel Graphics Driver" component. It allows attacker… |
CVE-2016-4686 | Medium | 4.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. The issue involves the "Contacts" component, which does not prevent an app's Ad… |
CVE-2016-4675 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS befor… |
CVE-2016-4617 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves a sandbox escape related to launchctl process spawning in… |
CVE-2016-9637 | High | 7.5 | 2017-02-17 | The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to… |
CVE-2017-3801 | High | 8.8 | 2017-02-15 | A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items… |
CVE-2016-8972 | High | 7.8 | 2017-02-15 | IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006, IV… |
CVE-2016-6079 | High | 7.8 | 2017-02-15 | IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs… |
CVE-2016-1883 | High | 7.8 | 2017-02-15 | The issetugid system call in the Linux compatibility layer in FreeBSD 9.3, 10.1, and 10.2 allows local users to gain privilege via unspecified vectors. |
CVE-2016-1881 | High | 7.8 | 2017-02-15 | The kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibili… |
CVE-2016-1880 | High | 7.8 | 2017-02-15 | The Linux compatibility layer in the kernel in FreeBSD 9.3, 10.1, and 10.2 allows local users to read portions of kernel memory and potentially gain privilege… |
CVE-2016-10089 | High | 7.8 | 2017-02-15 | Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. |
CVE-2016-9366 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9353 | High | 7.8 | 2017-02-13 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key har… |
CVE-2016-9345 | Medium | 6.8 | 2017-02-13 | An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local a… |
CVE-2016-8363 | Critical | 10.0 | 2017-02-13 | An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2… |
CVE-2016-8357 | High | 7.1 | 2017-02-13 | An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the appli… |
CVE-2016-8353 | Medium | 6.4 | 2017-02-13 | An issue was discovered in OSIsoft PI Web API 2015 R2 (Version 1.5.1). There is a weakness in this product that may allow an attacker to access the PI system w… |
CVE-2016-8659 | High | 7.0 | 2017-02-13 | Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending… |
CVE-2015-8768 | Critical | 9.8 | 2017-02-13 | click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alter… |
CVE-2017-3813 | High | 7.8 | 2017-02-09 | A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local at… |
CVE-2016-8494 | High | 7.2 | 2017-02-09 | Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui… |
CVE-2016-5934 | High | 7.3 | 2017-02-08 | IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the… |
CVE-2016-8481 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8480 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2016-8476 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8421 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8420 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8419 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-2779 | High | 7.8 | 2017-02-07 | runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buff… |
CVE-2016-10044 | High | 7.8 | 2017-02-07 | The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass… |
CVE-2015-2794 | Critical | 9.8 | 2017-02-06 | The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to… |
CVE-2016-10150 | Critical | 9.8 | 2017-02-06 | Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a d… |
CVE-2016-9871 | High | 7.2 | 2017-02-03 | EMC Isilon OneFS 7.2.1.0 - 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x is affected by a privilege escalati… |
CVE-2016-8216 | Medium | 6.7 | 2017-02-03 | EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all ver… |
CVE-2016-6028 | Medium | 4.3 | 2017-02-01 | IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view. |
CVE-2016-3053 | High | 7.8 | 2017-02-01 | IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. |
CVE-2016-9403 | Critical | 9.8 | 2017-01-31 | newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a m… |
CVE-2016-6268 | High | 7.8 | 2017-01-30 | Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary cod… |
CVE-2016-10013 | High | 7.8 | 2017-01-26 | Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation. |
CVE-2016-9386 | High | 7.8 | 2017-01-23 | The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges… |
CVE-2016-9382 | High | 7.8 | 2017-01-23 | Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of serv… |
CVE-2016-9012 | High | 8.8 | 2017-01-23 | CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane… |
CVE-2016-5876 | Medium | 5.9 | 2017-01-23 | ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request. |
CVE-2016-5720 | High | 7.8 | 2017-01-23 | Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan ho… |
CVE-2016-5237 | Medium | 4.8 | 2017-01-23 | Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privi… |
CVE-2016-4340 | High | 8.8 | 2017-01-23 | The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows re… |
CVE-2016-10156 | High | 7.8 | 2017-01-23 | A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers… |
CVE-2016-8644 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. |
CVE-2016-10086 | High | 8.1 | 2017-01-18 | RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task informat… |
CVE-2016-6527 | High | 7.8 | 2017-01-18 | The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and r… |
CVE-2016-6526 | High | 7.8 | 2017-01-18 | The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and re… |
CVE-2014-9910 | High | 7.0 | 2017-01-18 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2014-9909 | High | 7.0 | 2017-01-18 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2010-5327 | High | 8.8 | 2017-01-13 | Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. |
CVE-2016-8467 | Medium | 5.5 | 2017-01-13 | An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. This issue is rated… |
CVE-2015-3188 | Critical | 9.8 | 2017-01-13 | The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-6492 | High | 7.8 | 2017-01-12 | The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes a… |
CVE-2016-8221 | High | 7.0 | 2017-01-12 | Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules… |
CVE-2016-8468 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in Binder could enable a local malicious application to execute arbitrary code within the context of a privileged proce… |
CVE-2016-8466 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8465 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8464 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8458 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2016-8457 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8456 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8455 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8454 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8453 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8452 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8451 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2016-8450 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8449 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8448 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local malicious application to ex… |
CVE-2016-8447 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local malicious application to ex… |
CVE-2016-8446 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local malicious application to ex… |
CVE-2016-8445 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in MediaTek components, including the thermal driver and video driver, could enable a local malicious application to ex… |
CVE-2016-8436 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8433 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-8432 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8431 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8430 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8429 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8428 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8427 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8426 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8425 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8424 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8423 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of t… |