CWE-284 · Improper Access Control (page 58)
Page 58 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-1894 | High | 8.1 | 2017-02-07 | NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-3020 | Medium | 5.5 | 2017-02-07 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validatio… |
CVE-2016-6095 | Critical | 9.8 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2016-9008 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. |
CVE-2016-8938 | Critical | 10.0 | 2017-02-01 | IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be execute… |
CVE-2016-8932 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable ser… |
CVE-2016-8931 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable ser… |
CVE-2016-2942 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run o… |
CVE-2016-0320 | Medium | 4.3 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects… |
CVE-2016-6105 | High | 8.2 | 2017-02-01 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to… |
CVE-2016-8942 | Low | 3.1 | 2017-02-01 | IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the serve… |
CVE-2016-6085 | Medium | 6.5 | 2017-02-01 | IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers. |
CVE-2016-6044 | Medium | 4.3 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker… |
CVE-2016-5990 | Medium | 6.3 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the s… |
CVE-2016-5964 | Critical | 9.8 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute… |
CVE-2016-9415 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via ve… |
CVE-2016-9413 | Medium | 6.5 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks v… |
CVE-2016-9412 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and s… |
CVE-2015-8973 | High | 8.3 | 2017-01-31 | xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended ac… |
CVE-2016-5026 | Medium | 5.5 | 2017-01-30 | hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory. |
CVE-2015-8140 | Medium | 4.8 | 2017-01-30 | The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network. |
CVE-2015-8139 | Medium | 5.3 | 2017-01-30 | ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors. |
CVE-2016-8330 | Low | 3.7 | 2017-01-27 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult t… |
CVE-2016-8325 | Critical | 9.1 | 2017-01-27 | Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Internal Operations). Supported versions that are affect… |
CVE-2016-8324 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8323 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8320 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Core). Supp… |
CVE-2016-8319 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8317 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that… |
CVE-2016-8316 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8315 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure Code). Supported vers… |
CVE-2016-8312 | High | 8.2 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8311 | Medium | 6.5 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8309 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8307 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8304 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8300 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8299 | Medium | 6.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8298 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8297 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8282 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-1920 | Medium | 5.5 | 2017-01-27 | Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certif… |
CVE-2016-8227 | High | 7.8 | 2017-01-26 | Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute co… |
CVE-2016-7792 | High | 8.8 | 2017-01-23 | Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it. |
CVE-2014-8362 | Critical | 9.8 | 2017-01-23 | Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled inter… |
CVE-2016-8643 | Medium | 4.3 | 2017-01-20 | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. |
CVE-2016-8642 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. |
CVE-2016-9016 | High | 8.8 | 2017-01-19 | Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. |
CVE-2016-7794 | Critical | 9.8 | 2017-01-19 | sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name. |
CVE-2016-7793 | High | 8.8 | 2017-01-19 | sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL. |
CVE-2016-7545 | High | 8.8 | 2017-01-19 | SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. |
CVE-2016-5217 | Medium | 6.5 | 2017-01-19 | The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged p… |
CVE-2016-5206 | High | 8.8 | 2017-01-19 | The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a… |
CVE-2016-10148 | Medium | 4.3 | 2017-01-18 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugin… |
CVE-2016-8606 | Critical | 9.8 | 2017-01-12 | The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack. |
CVE-2016-8444 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm camera could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-8435 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-8434 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-8415 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8412 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm camera could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-8399 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the cont… |
CVE-2016-8394 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2016-8393 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2016-8392 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8391 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-6791 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-6790 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) could enable a local malicious application to execute arbitrary code within the… |
CVE-2016-6789 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) could enable a local malicious application to execute arbitrary code within the… |
CVE-2016-6785 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-6784 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-6783 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-6782 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-6781 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2016-6780 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-6779 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-6778 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-6777 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6776 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6775 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6771 | Medium | 5.3 | 2017-01-12 | An elevation of privilege vulnerability in Telephony could enable a local malicious application to access system functions beyond its access level. This issue… |
CVE-2016-6770 | Low | 3.3 | 2017-01-12 | An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. Thi… |
CVE-2016-6769 | Medium | 4.6 | 2017-01-12 | An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN. This issue is rated as M… |
CVE-2016-6768 | High | 7.8 | 2017-01-12 | A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the con… |
CVE-2016-6763 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Telephony could enable a local malicious application to use a specially crafted file to cause a device hang or reboot. Thi… |
CVE-2016-6761 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6760 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6759 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6758 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6755 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2015-4594 | Critical | 9.8 | 2017-01-10 | eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new sessio… |
CVE-2016-10124 | High | 8.6 | 2017-01-09 | An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent sess… |
CVE-2016-4307 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can ca… |
CVE-2016-4305 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call… |
CVE-2016-4304 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api… |
CVE-2016-10030 | High | 8.1 | 2017-01-05 | The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd da… |
CVE-2016-10105 | Critical | 9.8 | 2017-01-03 | admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code… |
CVE-2016-10085 | High | 7.2 | 2016-12-30 | admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter. |
CVE-2016-10084 | High | 7.2 | 2016-12-30 | admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka… |
CVE-2016-10082 | Critical | 9.8 | 2016-12-30 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time insta… |
CVE-2016-9877 | Critical | 9.8 | 2016-12-29 | An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x be… |