CWE-284 · Improper Access Control (page 76)
Page 76 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6777 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6776 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6775 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2016-6771 | Medium | 5.3 | 2017-01-12 | An elevation of privilege vulnerability in Telephony could enable a local malicious application to access system functions beyond its access level. This issue… |
CVE-2016-6770 | Low | 3.3 | 2017-01-12 | An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. Thi… |
CVE-2016-6769 | Medium | 4.6 | 2017-01-12 | An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN. This issue is rated as M… |
CVE-2016-6768 | High | 7.8 | 2017-01-12 | A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the con… |
CVE-2016-6763 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Telephony could enable a local malicious application to use a specially crafted file to cause a device hang or reboot. Thi… |
CVE-2016-6761 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6760 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6759 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6758 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6755 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2015-4594 | Critical | 9.8 | 2017-01-10 | eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new sessio… |
CVE-2016-10124 | High | 8.6 | 2017-01-09 | An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent sess… |
CVE-2016-4307 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can ca… |
CVE-2016-4305 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call… |
CVE-2016-4304 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api… |
CVE-2016-10030 | High | 8.1 | 2017-01-05 | The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd da… |
CVE-2016-10105 | Critical | 9.8 | 2017-01-03 | admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code… |
CVE-2016-10085 | High | 7.2 | 2016-12-30 | admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter. |
CVE-2016-10084 | High | 7.2 | 2016-12-30 | admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka… |
CVE-2016-10082 | Critical | 9.8 | 2016-12-30 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time insta… |
CVE-2016-9877 | Critical | 9.8 | 2016-12-29 | An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x be… |
CVE-2016-7967 | High | 8.1 | 2016-12-23 | KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context b… |
CVE-2016-5192 | Medium | 6.5 | 2016-12-18 | Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-or… |
CVE-2016-5189 | Medium | 6.5 | 2016-12-18 | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which a… |
CVE-2016-9951 | Medium | 6.5 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This… |
CVE-2016-8824 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where improper acces… |
CVE-2016-8821 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may… |
CVE-2016-9838 | High | 7.5 | 2016-12-16 | An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the se… |
CVE-2016-9565 | Critical | 9.8 | 2016-12-15 | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafte… |
CVE-2016-1000156 | Critical | 9.8 | 2016-12-14 | Mailcwp remote file upload vulnerability incomplete fix v1.100 |
CVE-2016-7952 | High | 7.5 | 2016-12-13 | X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData… |
CVE-2016-7946 | High | 7.5 | 2016-12-13 | X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields. |
CVE-2016-9920 | High | 7.5 | 2016-12-08 | steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not prope… |
CVE-2016-5341 | Medium | 5.9 | 2016-12-06 | The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service (GPS signal-acquisition delay) via an incorrect… |
CVE-2016-9836 | Critical | 9.8 | 2016-12-05 | The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded… |
CVE-2016-9835 | Critical | 9.8 | 2016-12-05 | Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP o… |
CVE-2016-9157 | Critical | 9.8 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to u… |
CVE-2016-9156 | High | 7.3 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the fil… |
CVE-2016-3044 | Medium | 6.5 | 2016-12-01 | The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite… |
CVE-2016-2887 | High | 8.1 | 2016-11-30 | IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via u… |
CVE-2016-2874 | Low | 3.1 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information… |
CVE-2016-8222 | Medium | 4.4 | 2016-11-30 | A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level… |
CVE-2016-8223 | High | 7.8 | 2016-11-29 | During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on so… |
CVE-2016-5393 | High | 8.8 | 2016-11-29 | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with… |
CVE-2016-8645 | Medium | 5.5 | 2016-11-28 | The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted a… |
CVE-2016-8633 | Medium | 6.8 | 2016-11-28 | drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via craf… |
CVE-2016-8630 | Medium | 5.5 | 2016-11-28 | The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (… |
CVE-2016-2929 | High | 8.1 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-for… |
CVE-2016-0319 | High | 7.5 | 2016-11-25 | The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to r… |
CVE-2016-0318 | Medium | 5.0 | 2016-11-25 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows… |
CVE-2016-0317 | Medium | 6.5 | 2016-11-25 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspe… |
CVE-2016-6747 | Medium | 5.5 | 2016-11-25 | A denial of service vulnerability in Mediaserver in Android before 2016-11-05 could enable an attacker to use a specially crafted file to cause a device hang o… |
CVE-2016-6725 | Critical | 9.8 | 2016-11-25 | A remote code execution vulnerability in the Qualcomm crypto driver in Android before 2016-11-05 could enable a remote attacker to execute arbitrary code withi… |
CVE-2016-6724 | Medium | 5.5 | 2016-11-25 | A denial of service vulnerability in the Input Manager Service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and… |
CVE-2016-6723 | Medium | 4.7 | 2016-11-25 | A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 befo… |
CVE-2016-6719 | Medium | 5.5 | 2016-11-25 | An elevation of privilege vulnerability in the Bluetooth component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01… |
CVE-2016-6716 | Medium | 5.5 | 2016-11-25 | An elevation of privilege vulnerability in the AOSP Launcher in Android 7.0 before 2016-11-01 could allow a local malicious application to create shortcuts tha… |
CVE-2016-6715 | Medium | 5.5 | 2016-11-25 | An elevation of privilege vulnerability in the Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7… |
CVE-2016-6714 | Medium | 5.5 | 2016-11-25 | A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially… |
CVE-2016-6713 | Medium | 5.5 | 2016-11-25 | A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially… |
CVE-2016-6708 | Medium | 5.5 | 2016-11-25 | An elevation of privilege in the System UI in Android 7.0 before 2016-11-01 could enable a local malicious user to bypass the security prompt of your work prof… |
CVE-2016-6703 | High | 7.8 | 2016-11-25 | A remote code execution vulnerability in an Android runtime library in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11… |
CVE-2016-6702 | High | 7.8 | 2016-11-25 | A remote code execution vulnerability in libjpeg in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable an attacker using a speci… |
CVE-2016-6701 | High | 7.8 | 2016-11-25 | A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corru… |
CVE-2016-9155 | Critical | 9.8 | 2016-11-22 | The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CC… |
CVE-2016-7165 | Medium | 6.4 | 2016-11-15 | A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC… |
CVE-2016-7248 | High | 7.8 | 2016-11-10 | Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers… |
CVE-2016-7247 | High | 7.5 | 2016-11-10 | Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow physically proximate att… |
CVE-2016-7244 | Medium | 5.5 | 2016-11-10 | Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial o… |
CVE-2016-7237 | Medium | 6.5 | 2016-11-10 | Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Serv… |
CVE-2016-7226 | Medium | 6.1 | 2016-11-10 | Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gai… |
CVE-2016-7225 | Medium | 6.1 | 2016-11-10 | Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gai… |
CVE-2016-7224 | Medium | 6.1 | 2016-11-10 | Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 do… |
CVE-2016-7223 | Medium | 6.1 | 2016-11-10 | Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 do… |
CVE-2016-7212 | High | 7.8 | 2016-11-10 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold… |
CVE-2016-9111 | Medium | 6.8 | 2016-11-07 | Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical acces… |
CVE-2016-9190 | High | 7.8 | 2016-11-04 | Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Exten… |
CVE-2016-9182 | High | 7.5 | 2016-11-04 | Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PH… |
CVE-2016-3060 | Medium | 5.7 | 2016-10-29 | Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3… |
CVE-2016-8580 | Critical | 9.8 | 2016-10-28 | PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code ex… |
CVE-2016-8296 | High | 7.6 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to a… |
CVE-2016-8293 | High | 8.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect conf… |
CVE-2016-8292 | Medium | 4.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidential… |
CVE-2016-8291 | High | 8.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect conf… |
CVE-2016-8288 | Low | 3.1 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related t… |
CVE-2016-8285 | Medium | 4.8 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality a… |
CVE-2016-8281 | High | 7.6 | 2016-10-25 | Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote a… |
CVE-2016-5622 | Medium | 6.1 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 1… |
CVE-2016-5621 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 and 12.0.3, 12.1… |
CVE-2016-5620 | Medium | 5.4 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 1… |
CVE-2016-5619 | High | 8.1 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 1… |
CVE-2016-5615 | Low | 3.3 | 2016-10-25 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx. |
CVE-2016-5613 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect avai… |
CVE-2016-5610 | Medium | 6.8 | 2016-10-25 | Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect conf… |
CVE-2016-5608 | Medium | 5.5 | 2016-10-25 | Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect avai… |
CVE-2016-5607 | High | 8.8 | 2016-10-25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 1… |
CVE-2016-5606 | Medium | 6.1 | 2016-10-25 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect integrity and availability via vectors related to Kernel Zones. |