CWE-284 · Improper Access Control (page 61)
Page 61 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6198 | Medium | 5.5 | 2016-08-06 | The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows… |
CVE-2014-9865 | High | 7.8 | 2016-08-06 | drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly restrict user-space input, whi… |
CVE-2016-3839 | Medium | 5.5 | 2016-08-05 | Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of… |
CVE-2016-3838 | Medium | 5.5 | 2016-08-05 | Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted application that uses the a… |
CVE-2014-9901 | High | 7.5 | 2016-08-05 | The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attackers to cause a denia… |
CVE-2016-6150 | Critical | 9.8 | 2016-08-05 | The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restr… |
CVE-2016-6144 | High | 8.1 | 2016-08-05 | The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not… |
CVE-2016-6140 | Critical | 9.8 | 2016-08-05 | SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591. |
CVE-2016-6258 | High | 8.8 | 2016-08-02 | The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-pa… |
CVE-2016-5229 | Critical | 9.8 | 2016-08-02 | Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute… |
CVE-2016-4373 | Critical | 9.8 | 2016-08-01 | The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted seri… |
CVE-2016-1608 | High | 8.8 | 2016-08-01 | vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via… |
CVE-2016-3992 | Medium | 6.2 | 2016-07-26 | cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /… |
CVE-2016-5130 | Medium | 6.5 | 2016-07-23 | content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allo… |
CVE-2016-4591 | High | 7.5 | 2016-07-22 | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the loca… |
CVE-2016-5388 | High | 8.1 | 2016-07-19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applica… |
CVE-2016-5386 | High | 8.1 | 2016-07-19 | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications… |
CVE-2016-5661 | High | 8.8 | 2016-07-15 | Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitra… |
CVE-2016-0357 | Medium | 4.3 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduct clickjacking atta… |
CVE-2016-0340 | High | 7.4 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote a… |
CVE-2016-0339 | Medium | 5.6 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which m… |
CVE-2016-5807 | High | 8.1 | 2016-07-15 | Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or chan… |
CVE-2016-5109 | Medium | 4.3 | 2016-07-13 | Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Appl… |
CVE-2016-5008 | Critical | 9.8 | 2016-07-13 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass… |
CVE-2016-4215 | Critical | 9.8 | 2016-07-13 | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017… |
CVE-2016-3276 | Low | 3.1 | 2016-07-13 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing… |
CVE-2016-3274 | Low | 3.1 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browse… |
CVE-2016-3245 | Medium | 6.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "I… |
CVE-2016-3244 | Medium | 4.3 | 2016-07-13 | Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature Bypass." |
CVE-2016-3818 | Medium | 5.5 | 2016-07-11 | libc in Android 4.x before 4.4.4 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28740702. |
CVE-2014-9798 | Medium | 5.5 | 2016-07-11 | platform/msm_shared/dev_tree.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 devices does not check the relationship between tags addresse… |
CVE-2016-0315 | High | 8.8 | 2016-07-08 | The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain sessi… |
CVE-2016-4979 | High | 7.5 | 2016-07-06 | The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for H… |
CVE-2016-0906 | High | 8.8 | 2016-07-06 | The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authent… |
CVE-2016-0391 | Critical | 9.8 | 2016-07-02 | The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier fo… |
CVE-2015-8801 | Low | 2.9 | 2016-06-30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer… |
CVE-2016-0349 | Medium | 6.5 | 2016-06-30 | IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and… |
CVE-2016-5101 | High | 8.8 | 2016-06-29 | Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail messa… |
CVE-2016-1237 | Medium | 5.5 | 2016-06-29 | nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl… |
CVE-2016-0304 | High | 8.1 | 2016-06-29 | The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is… |
CVE-2016-3713 | High | 7.1 | 2016-06-27 | The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm… |
CVE-2016-3707 | High | 8.1 | 2016-06-27 | The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327… |
CVE-2016-0279 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2016-0278 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2016-0277 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2015-7473 | Low | 2.5 | 2016-06-26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +con… |
CVE-2016-1190 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors. |
CVE-2016-0914 | Medium | 6.3 | 2016-06-23 | EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before P… |
CVE-2016-4811 | Medium | 5.6 | 2016-06-19 | The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attack… |
CVE-2016-0392 | High | 8.4 | 2016-06-19 | IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x be… |
CVE-2016-4813 | High | 8.8 | 2016-06-19 | NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account. |
CVE-2016-3226 | Medium | 6.5 | 2016-06-16 | Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service ha… |
CVE-2016-5366 | High | 7.5 | 2016-06-14 | Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vuln… |
CVE-2016-3698 | High | 8.1 | 2016-06-13 | libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attacker… |
CVE-2014-9773 | High | 7.5 | 2016-06-13 | modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR… |
CVE-2016-5302 | Critical | 9.8 | 2016-06-13 | Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management networ… |
CVE-2016-5104 | Medium | 5.3 | 2016-06-13 | The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate… |
CVE-2016-4911 | Medium | 4.3 | 2016-06-13 | The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of to… |
CVE-2016-1543 | High | 7.5 | 2016-06-13 | The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypa… |
CVE-2016-2831 | High | 8.8 | 2016-06-13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote… |
CVE-2016-2829 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demo… |
CVE-2016-2825 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL. |
CVE-2016-2822 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu. |
CVE-2016-2785 | Critical | 9.8 | 2016-06-10 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended au… |
CVE-2016-4524 | Medium | 6.5 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive info… |
CVE-2016-4495 | Medium | 5.3 | 2016-06-10 | KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allow remote attackers to bypass intended access restrictions and read a configuration file via un… |
CVE-2016-2150 | High | 7.1 | 2016-06-09 | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-… |
CVE-2016-1581 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data… |
CVE-2016-3708 | High | 7.1 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespa… |
CVE-2016-3703 | Medium | 5.3 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API… |
CVE-2016-4369 | High | 8.8 | 2016-06-08 | HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 allows remote authenticated users to ex… |
CVE-2016-4963 | Medium | 4.7 | 2016-06-07 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confu… |
CVE-2014-8177 | Medium | 6.5 | 2016-06-07 | The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_me… |
CVE-2016-1699 | Medium | 6.5 | 2016-06-05 | WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not e… |
CVE-2016-1697 | High | 8.8 | 2016-06-05 | The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame… |
CVE-2016-1696 | High | 8.8 | 2016-06-05 | The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Orig… |
CVE-2016-1694 | Medium | 5.3 | 2016-06-05 | browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote a… |
CVE-2016-1693 | Medium | 5.3 | 2016-06-05 | browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Remova… |
CVE-2016-1692 | Medium | 5.3 | 2016-06-05 | WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a Serv… |
CVE-2016-1682 | Medium | 6.1 | 2016-06-05 | The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google C… |
CVE-2016-1676 | High | 8.8 | 2016-06-05 | extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote a… |
CVE-2016-1675 | High | 8.8 | 2016-06-05 | Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattac… |
CVE-2016-1672 | High | 8.8 | 2016-06-05 | The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles… |
CVE-2016-4810 | High | 7.5 | 2016-06-01 | Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Pol… |
CVE-2016-4502 | High | 7.5 | 2016-05-31 | Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitr… |
CVE-2016-4501 | Critical | 9.1 | 2016-05-31 | Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and m… |
CVE-2016-1999 | Critical | 9.8 | 2016-05-30 | The server in HP Release Control 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to th… |
CVE-2016-1406 | High | 8.8 | 2016-05-25 | The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to… |
CVE-2016-2159 | Medium | 4.3 | 2016-05-22 | The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x be… |
CVE-2016-3728 | High | 8.8 | 2016-05-20 | Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to… |
CVE-2016-2100 | Medium | 5.4 | 2016-05-20 | Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_boo… |
CVE-2016-1844 | Medium | 5.3 | 2016-05-20 | The Messages component in Apple OS X before 10.11.5 mishandles roster changes, which allows remote attackers to modify contact lists via unspecified vectors. |
CVE-2016-1842 | High | 7.5 | 2016-05-20 | MapKit in Apple iOS before 9.3.2, OS X before 10.11.5, and watchOS before 2.2.1 does not use HTTPS for shared links, which allows remote attackers to obtain se… |
CVE-2016-1806 | High | 7.8 | 2016-05-20 | Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app. |
CVE-2016-1805 | High | 7.8 | 2016-05-20 | CoreStorage in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app. |
CVE-2016-1797 | High | 7.8 | 2016-05-20 | Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to bypass intended FontValidator sandbox-policy restrictions and execute arbitrary code… |
CVE-2016-0731 | Medium | 4.9 | 2016-05-18 | The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL confi… |
CVE-2016-0323 | Medium | 6.5 | 2016-05-17 | The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to disable X.509 certificate validation, a… |
CVE-2015-8838 | Medium | 5.9 | 2016-05-16 | ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows ma… |
CVE-2016-1668 | High | 8.8 | 2016-05-14 | The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an… |