CWE-284: Improper Access Control, page 164

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

1. 7.8CVE-2016-6790EPSS 1.6%2017-01-12

   An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could b…

2. 7.8CVE-2016-6789EPSS 1.8%2017-01-12

   An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could b…

3. 7.0CVE-2016-6785EPSS 1.4%2017-01-12

   An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a priv…

4. 7.0CVE-2016-6784EPSS 0.5%2017-01-12

   An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a priv…

5. 7.0CVE-2016-6783EPSS 0.6%2017-01-12

   An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a priv…

6. 7.0CVE-2016-6782EPSS 1.4%2017-01-12

   An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a priv…

7. 7.0CVE-2016-6781EPSS 1.4%2017-01-12

   An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a priv…

8. 7.0CVE-2016-6780EPSS 1.4%2017-01-12

   An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising…

9. 7.0CVE-2016-6779EPSS 1.4%2017-01-12

   An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising…

10. 7.0CVE-2016-6778EPSS 1.4%2017-01-12

    An elevation of privilege vulnerability in the HTC sound codec driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising…

11. 7.8CVE-2016-6777EPSS 1.8%2017-01-12

    An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local perma…

12. 7.8CVE-2016-6776EPSS 1.8%2017-01-12

    An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local perma…

13. 7.8CVE-2016-6775EPSS 1.8%2017-01-12

    An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local perma…

14. 5.3CVE-2016-6771EPSS 0.2%2017-01-12

    An elevation of privilege vulnerability in Telephony could enable a local malicious application to access system functions beyond its access level. This issue is rated as Moderate because it is a local bypass of restrictions on a constrain…

15. 3.3CVE-2016-6770EPSS 0.3%2017-01-12

    An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. This issue is rated as Moderate because it is a local bypass of restrictions on a c…

16. 4.6CVE-2016-6769EPSS 0.2%2017-01-12

    An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN. This issue is rated as Moderate because it first requires physical access to an unlocked device where Sm…

17. 7.8CVE-2016-6768EPSS 0.8%2017-01-12

    A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibil…

18. 5.5CVE-2016-6763EPSS 0.3%2017-01-12

    A denial of service vulnerability in Telephony could enable a local malicious application to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of local permanent denial of ser…

19. 7.8CVE-2016-6761EPSS 1.6%2017-01-12

    An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain …

20. 7.8CVE-2016-6760EPSS 1.6%2017-01-12

    An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain …

21. 7.8CVE-2016-6759EPSS 1.6%2017-01-12

    An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain …

22. 7.8CVE-2016-6758EPSS 1.6%2017-01-12

    An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain …

23. 7.0CVE-2016-6755EPSS 1.2%2017-01-12

    An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising…

24. 9.8CVE-2015-4594ExploitEPSS 6.2%2017-01-10

    eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID.

25. 8.6CVE-2016-10124EPSS 1.5%2017-01-09

    An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buff…

26. 5.5CVE-2016-4307EPSS 0.5%2017-01-06

    A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can cause an access violation in KL1 kernel driver resulting in local system denial of…

27. 5.5CVE-2016-4305EPSS 0.5%2017-01-06

    A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of…

28. 5.5CVE-2016-4304EPSS 0.5%2017-01-06

    A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api call request can cause a access violation exception in KLIF kernel driver result…

29. 8.1CVE-2016-10030EPSS 2.5%2017-01-05

    The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability cou…

30. 9.8CVE-2016-10105EPSS 2.3%2017-01-03

    admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.

31. 7.2CVE-2016-10085EPSS 1.8%2016-12-30

    admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.

32. 7.2CVE-2016-10084EPSS 1.8%2016-12-30

    admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).

33. 9.8CVE-2016-10082EPSS 2.9%2016-12-30

    include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it …

34. 9.8CVE-2016-9877EPSS 1.4%2016-12-29

    An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a usern…

35. 8.1CVE-2016-7967EPSS 1.9%2016-12-23

    KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

36. 6.5CVE-2016-5192EPSS 1.2%2016-12-18

    Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages.

37. 6.5CVE-2016-5189EPSS 1.0%2016-12-18

    Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via craf…

38. 6.5CVE-2016-9951ExploitEPSS 6.7%2016-12-17

    An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prom…

39. 7.8CVE-2016-8824EPSS 0.3%2016-12-16

    All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where improper access controls allow a regular user to write a part of the registry intended for pri…

40. 7.8CVE-2016-8821EPSS 0.3%2016-12-16

    All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may allow a user to access arbitrary physical memory, leading to an escalation of pr…

41. 7.5CVE-2016-9838ExploitEPSS 14%2016-12-16

    An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's…

42. 9.8CVE-2016-9565ExploitEPSS 23%2016-12-15

    MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists bec…

43. 9.8CVE-2016-1000156EPSS 2.8%2016-12-14

    Mailcwp remote file upload vulnerability incomplete fix v1.100

44. 7.5CVE-2016-7952EPSS 2.3%2016-12-13

    X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached …

45. 7.5CVE-2016-7946EPSS 3.0%2016-12-13

    X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.

46. 7.5CVE-2016-9920EPSS 5.6%2016-12-08

    steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command l…

47. 5.9CVE-2016-5341EPSS 1.0%2016-12-06

    The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service (GPS signal-acquisition delay) via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net…

48. 9.8CVE-2016-9836EPSS 1.9%2016-12-05

    The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the…

49. 9.8CVE-2016-9835EPSS 3.9%2016-12-05

    Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

50. 9.8CVE-2016-9157EPSS 3.3%2016-12-05

    A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to por…