CWE-284 · Improper Access Control (page 57)
Page 57 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10369 | High | 7.8 | 2017-05-08 | unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch… |
CVE-2016-7054 | High | 7.5 | 2017-05-04 | In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can… |
CVE-2016-9976 | High | 8.4 | 2017-05-03 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL re… |
CVE-2016-2930 | High | 7.5 | 2017-05-03 | IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512. |
CVE-2016-8588 | High | 7.3 | 2017-04-28 | The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell me… |
CVE-2016-8587 | High | 7.3 | 2017-04-28 | dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archi… |
CVE-2016-8584 | Critical | 9.8 | 2017-04-28 | Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessi… |
CVE-2016-5551 | Low | 2.8 | 2017-04-24 | Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected… |
CVE-2015-0104 | High | 8.8 | 2017-04-24 | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo… |
CVE-2016-2433 | High | 8.8 | 2017-04-21 | The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context… |
CVE-2016-1518 | High | 8.1 | 2017-04-21 | The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers… |
CVE-2016-3733 | Medium | 4.3 | 2017-04-20 | The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated u… |
CVE-2016-3729 | Medium | 6.5 | 2017-04-20 | The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to… |
CVE-2016-4850 | High | 8.1 | 2017-04-20 | LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. |
CVE-2016-1220 | Medium | 4.3 | 2017-04-20 | Cybozu Garoon before 4.2.2 does not properly restrict access. |
CVE-2016-6338 | Medium | 6.8 | 2017-04-20 | ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to b… |
CVE-2016-6337 | High | 7.5 | 2017-04-20 | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function a… |
CVE-2016-6336 | Medium | 6.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppres… |
CVE-2016-6331 | High | 7.5 | 2017-04-20 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via… |
CVE-2016-4874 | Low | 3.5 | 2017-04-17 | Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack. |
CVE-2016-7032 | High | 7.0 | 2017-04-14 | sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) syst… |
CVE-2016-4032 | Medium | 4.6 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-4031 | Medium | 6.8 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-4030 | Medium | 6.8 | 2017-04-13 | Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9… |
CVE-2016-6143 | Critical | 9.8 | 2017-04-13 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806. |
CVE-2016-4800 | Critical | 9.8 | 2017-04-13 | The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource rest… |
CVE-2015-8284 | High | 8.8 | 2017-04-13 | SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions. |
CVE-2016-1178 | Medium | 6.5 | 2017-04-12 | The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via u… |
CVE-2016-6605 | High | 7.5 | 2017-04-10 | Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization. |
CVE-2016-5058 | High | 7.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay. |
CVE-2016-5054 | High | 7.5 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay. |
CVE-2015-8275 | Medium | 5.5 | 2017-04-10 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files. |
CVE-2015-7265 | High | 7.5 | 2017-04-10 | Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. |
CVE-2015-7263 | High | 7.5 | 2017-04-10 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. |
CVE-2014-3930 | High | 7.5 | 2017-04-03 | lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresse… |
CVE-2014-3929 | High | 7.5 | 2017-04-03 | The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to… |
CVE-2014-3928 | Critical | 9.8 | 2017-04-03 | Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials. |
CVE-2016-8798 | High | 7.5 | 2017-04-02 | Huawei USG5500 with software V300R001C00 and V300R001C00 allows attackers to bypass the anti-DDoS module of the USGs to cause a denial of service condition on… |
CVE-2016-8794 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8793 | Medium | 6.7 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8792 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8791 | High | 7.1 | 2017-04-02 | Huawei Mate 8 phones with software Versions before NXT-AL10C00B386, Versions before NXT-CL00C92B386, Versions before NXT-DL00C17B386, Versions before NXT-TL00C… |
CVE-2016-8274 | High | 7.8 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE has a dynamic link library (DLL) hijack vulnerability; an attacker can make the system load malicious DLL files… |
CVE-2016-8273 | High | 7.8 | 2017-04-02 | Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software packa… |
CVE-2014-4707 | High | 8.8 | 2017-04-02 | Huawei Campus S7700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300; S9300 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C0… |
CVE-2016-8032 | High | 7.3 | 2017-03-31 | Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection… |
CVE-2015-4624 | High | 7.5 | 2017-03-31 | Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. |
CVE-2016-6807 | Critical | 9.8 | 2017-03-28 | Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect… |
CVE-2016-9468 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed… |
CVE-2016-9467 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files… |
CVE-2016-9462 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne… |
CVE-2016-9461 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was… |
CVE-2016-9460 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app w… |
CVE-2016-9122 | High | 7.5 | 2017-03-28 | go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a… |
CVE-2016-10144 | Critical | 9.8 | 2017-03-24 | coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check. |
CVE-2016-10130 | Medium | 5.9 | 2017-03-24 | The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by le… |
CVE-2015-8627 | Medium | 5.3 | 2017-03-23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded oc… |
CVE-2016-7468 | Medium | 5.9 | 2017-03-23 | An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerab… |
CVE-2016-5750 | High | 8.8 | 2017-03-23 | The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would… |
CVE-2016-5747 | High | 7.5 | 2017-03-23 | A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intend… |
CVE-2016-5239 | Critical | 9.8 | 2017-03-15 | The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vecto… |
CVE-2016-8010 | High | 7.8 | 2017-03-14 | Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier al… |
CVE-2016-8007 | Medium | 6.3 | 2017-03-14 | Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the pr… |
CVE-2015-8987 | Medium | 5.3 | 2017-03-14 | Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make… |
CVE-2014-9920 | Medium | 5.9 | 2017-03-14 | Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 90… |
CVE-2013-7461 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated user… |
CVE-2013-7460 | Medium | 5.5 | 2017-03-14 | A write protection and execution bypass vulnerability in McAfee (now Intel Security) Application Control (MAC) 6.1.0 for Linux and earlier allows authenticated… |
CVE-2016-9368 | High | 7.5 | 2017-03-14 | An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL… |
CVE-2016-9245 | Medium | 5.9 | 2017-03-07 | In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with B… |
CVE-2016-6255 | High | 7.5 | 2017-03-07 | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handle… |
CVE-2016-8236 | High | 7.5 | 2017-03-03 | Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than… |
CVE-2016-10065 | High | 7.8 | 2017-03-03 | The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have othe… |
CVE-2016-7408 | High | 8.8 | 2017-03-03 | The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. |
CVE-2016-10193 | Critical | 9.8 | 2017-03-03 | The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes… |
CVE-2016-9818 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP. |
CVE-2016-9817 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR… |
CVE-2016-9816 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2. |
CVE-2016-9815 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort. |
CVE-2016-8986 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Re… |
CVE-2016-8915 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same pro… |
CVE-2016-9956 | High | 7.5 | 2017-02-22 | The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script. |
CVE-2016-9378 | Medium | 5.5 | 2017-02-22 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users… |
CVE-2016-6077 | Medium | 5.3 | 2017-02-15 | IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document. IBM Refe… |
CVE-2016-10223 | Medium | 5.4 | 2017-02-14 | An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parame… |
CVE-2016-9356 | High | 7.8 | 2017-02-13 | An issue was discovered in Moxa DACenter Versions 1.4 and older. The application may suffer from an unquoted search path issue. |
CVE-2016-5815 | Critical | 9.8 | 2017-02-13 | An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and P… |
CVE-2016-5801 | High | 7.5 | 2017-02-13 | An issue was discovered in OmniMetrix OmniView, Version 1.2. Insufficient password requirements for the OmniView web application may allow an attacker to gain… |
CVE-2016-7565 | Critical | 9.8 | 2017-02-13 | install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter. |
CVE-2016-2788 | Critical | 9.8 | 2017-02-13 | MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping c… |
CVE-2016-2787 | Medium | 5.3 | 2017-02-13 | The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remo… |
CVE-2016-10026 | High | 7.5 | 2017-02-13 | ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI… |
CVE-2015-8832 | High | 8.8 | 2017-02-09 | Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own me… |
CVE-2015-6023 | High | 7.3 | 2017-02-09 | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access r… |
CVE-2016-9005 | Critical | 9.8 | 2017-02-08 | IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remo… |
CVE-2016-0308 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images. |
CVE-2016-0214 | High | 7.8 | 2017-02-08 | IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious f… |
CVE-2015-7494 | Low | 2.8 | 2017-02-08 | A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resour… |
CVE-2015-1976 | Medium | 5.5 | 2017-02-08 | IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash. |
CVE-2016-8418 | Critical | 9.8 | 2017-02-08 | A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel… |
CVE-2016-9639 | Critical | 9.1 | 2017-02-07 | Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. |