CWE-284 · Improper Access Control (page 62)
Page 62 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-1667 | High | 8.8 | 2016-05-14 | The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102… |
CVE-2016-2016 | Medium | 5.5 | 2016-05-14 | Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with… |
CVE-2016-2860 | Medium | 6.5 | 2016-05-13 | The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access r… |
CVE-2016-1117 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1062 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1044 | Critical | 10.0 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1042 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1041 | Critical | 10.0 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1040 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1039 | Critical | 9.8 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-1038 | Critical | 10.0 | 2016-05-11 | Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016… |
CVE-2016-0188 | High | 8.8 | 2016-05-11 | The User Mode Code Integrity (UMCI) implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protectio… |
CVE-2016-0183 | High | 8.8 | 2016-05-11 | The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allo… |
CVE-2016-0182 | High | 7.8 | 2016-05-11 | Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arb… |
CVE-2016-0179 | High | 7.8 | 2016-05-11 | Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code… |
CVE-2016-0170 | High | 8.8 | 2016-05-11 | GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Window… |
CVE-2016-3105 | High | 8.8 | 2016-05-09 | The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name. |
CVE-2015-5207 | Medium | 5.3 | 2016-05-09 | Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspe… |
CVE-2015-6552 | Critical | 9.8 | 2016-05-07 | The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7… |
CVE-2015-6550 | Critical | 9.8 | 2016-05-07 | bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4… |
CVE-2016-2014 | High | 8.1 | 2016-05-07 | HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to modify data or cause a denial of service via un… |
CVE-2016-2009 | High | 8.8 | 2016-05-07 | HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to execute arbitrary commands via a crafted serial… |
CVE-2016-2167 | Medium | 6.8 | 2016-05-05 | The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used… |
CVE-2014-9717 | Medium | 6.1 | 2016-05-02 | fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows loc… |
CVE-2012-6689 | High | 7.8 | 2016-05-02 | The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have… |
CVE-2016-2820 | Medium | 4.3 | 2016-04-30 | The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes… |
CVE-2016-2816 | Medium | 6.5 | 2016-04-30 | Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mixed-replace content… |
CVE-2016-1200 | Medium | 6.3 | 2016-04-30 | The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a… |
CVE-2015-8845 | Medium | 5.5 | 2016-04-27 | The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exis… |
CVE-2016-4081 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type, which allows… |
CVE-2016-4076 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns, which allows r… |
CVE-2016-4064 | High | 7.8 | 2016-04-22 | Use-after-free vulnerability in the XFA forms handling functionality in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute… |
CVE-2016-2354 | High | 8.8 | 2016-04-22 | The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers t… |
CVE-2016-3427 | Critical | 9.8 | 2016-04-21 | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality… |
CVE-2016-1658 | Medium | 4.3 | 2016-04-18 | The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attacker… |
CVE-2016-1656 | High | 7.5 | 2016-04-18 | The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified ve… |
CVE-2015-5247 | Medium | 6.5 | 2016-04-14 | The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (li… |
CVE-2011-4600 | Medium | 5.9 | 2016-04-14 | The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libv… |
CVE-2016-4018 | High | 7.3 | 2016-04-14 | The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain sens… |
CVE-2015-8550 | High | 8.2 | 2016-04-14 | Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writi… |
CVE-2016-0757 | Medium | 4.3 | 2016-04-13 | OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated… |
CVE-2016-3159 | Low | 3.8 | 2016-04-13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allow… |
CVE-2016-3158 | Low | 3.8 | 2016-04-13 | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows l… |
CVE-2015-7545 | Critical | 9.8 | 2016-04-13 | The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 d… |
CVE-2016-0153 | High | 7.8 | 2016-04-12 | OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 allows… |
CVE-2016-0088 | Critical | 9.3 | 2016-04-12 | Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted… |
CVE-2016-3165 | High | 7.5 | 2016-04-12 | The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions… |
CVE-2016-3162 | High | 8.1 | 2016-04-12 | The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute… |
CVE-2016-1866 | High | 8.1 | 2016-04-12 | Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inse… |
CVE-2015-8021 | Medium | 4.3 | 2016-04-12 | Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x before 11.2.1 HF11, 1… |
CVE-2016-3987 | Critical | 9.8 | 2016-04-12 | The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowse… |
CVE-2016-3985 | Medium | 6.5 | 2016-04-12 | The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenti… |
CVE-2016-3984 | Medium | 5.1 | 2016-04-08 | The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exch… |
CVE-2015-8681 | High | 7.8 | 2016-04-07 | The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-… |
CVE-2015-8680 | High | 7.8 | 2016-04-07 | The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, G… |
CVE-2015-8679 | Medium | 5.5 | 2016-04-07 | The Maxim_smartpa_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C… |
CVE-2015-8307 | High | 7.8 | 2016-04-07 | The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, G… |
CVE-2016-2277 | Medium | 6.3 | 2016-04-06 | IAB.exe in Rockwell Automation Integrated Architecture Builder (IAB) before 9.6.0.8 and 9.7.x before 9.7.0.2 allows remote attackers to execute arbitrary code… |
CVE-2016-2272 | High | 7.5 | 2016-04-06 | Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie. |
CVE-2016-0289 | Medium | 4.3 | 2016-04-05 | shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to b… |
CVE-2015-8523 | High | 7.5 | 2016-04-05 | The server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to cause a denial of service (service crash) via crafte… |
CVE-2016-1760 | Medium | 6.2 | 2016-03-29 | The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's eve… |
CVE-2016-0226 | High | 7.8 | 2016-03-28 | The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap… |
CVE-2016-1782 | Medium | 6.5 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypa… |
CVE-2016-1776 | Medium | 5.3 | 2016-03-24 | Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitiv… |
CVE-2016-1774 | Medium | 5.3 | 2016-03-24 | The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier… |
CVE-2016-1770 | Medium | 6.5 | 2016-03-24 | The Reminders component in Apple OS X before 10.11.4 allows attackers to bypass an intended user-confirmation requirement and trigger a dialing action via a te… |
CVE-2016-0222 | Medium | 4.3 | 2016-03-14 | IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-ord… |
CVE-2016-0208 | Low | 3.7 | 2016-03-14 | IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing… |
CVE-2015-7560 | Medium | 6.5 | 2016-03-13 | The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticat… |
CVE-2016-1638 | Medium | 6.3 | 2016-03-06 | extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, whic… |
CVE-2016-2243 | High | 7.9 | 2016-03-04 | Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access. |
CVE-2015-7490 | Low | 3.1 | 2016-03-03 | IBM InfoSphere Information Server 8.5 through FP3, 8.7 through FP2, 9.1 through 9.1.2.0, 11.3 through 11.3.1.2, and 11.5 allows remote authenticated users to b… |
CVE-2016-2278 | High | 7.2 | 2016-03-02 | Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to… |
CVE-2016-0225 | Medium | 4.9 | 2016-02-29 | IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive informa… |
CVE-2016-2275 | Critical | 9.8 | 2016-02-21 | The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client… |
CVE-2015-7577 | Medium | 5.3 | 2016-02-16 | activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x b… |
CVE-2015-2008 | Medium | 4.4 | 2016-02-15 | IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authentic… |
CVE-2016-1315 | High | 7.5 | 2016-02-12 | The proxy engine in Cisco Advanced Malware Protection (AMP), when used with Email Security Appliance (ESA) 9.5.0-201, 9.6.0-051, and 9.7.0-125, allows remote a… |
CVE-2016-2048 | Medium | 5.5 | 2016-02-08 | Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdm… |
CVE-2015-8361 | Critical | 9.1 | 2016-02-08 | Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain… |
CVE-2016-1302 | High | 8.8 | 2016-02-07 | Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with sof… |
CVE-2016-1301 | High | 8.8 | 2016-02-07 | The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112… |
CVE-2016-1905 | High | 7.7 | 2016-02-03 | The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted pa… |
CVE-2016-2049 | High | 8.8 | 2016-02-01 | examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the… |
CVE-2016-1492 | Medium | 6.1 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.5.48_ww for Android, when configured to receive files, does not require a password, which makes it easier for remot… |
CVE-2015-6317 | Medium | 6.5 | 2016-01-23 | Cisco Identity Services Engine (ISE) before 2.0 allows remote authenticated users to bypass intended web-resource access restrictions via a direct request, aka… |
CVE-2016-0611 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to… | |
CVE-2015-8512 | Medium | 4.6 | 2016-01-09 | The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proxima… |
CVE-2015-6933 | Medium | 6.3 | 2016-01-09 | The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2, VMware Player 7.x before 7.1.2, VMware Fusion 7.x before 7… |
CVE-2015-6862 | High | 8.4 | 2016-01-08 | HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified vectors. |
CVE-2015-5017 | Medium | 5.4 | 2016-01-03 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8… |
CVE-2015-1985 | Medium | 5.6 | 2016-01-03 | The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging t… |
CVE-2015-6851 | Medium | 6.7 | 2015-12-23 | EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workst… |
CVE-2015-1836 | High | 7.3 | 2015-12-21 | Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other produ… |
CVE-2015-7055 | | 2015-12-11 | AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute a… | |
CVE-2015-6848 | | 2015-11-27 | EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally p… | |
CVE-2015-5325 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulne… | |
CVE-2015-7865 | | 2015-11-24 | nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windo… | |
CVE-2015-5053 | | 2015-11-24 | The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU… |