← Back
CWE-284

7,447 CVEs • Abstraction: Pillar

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

JSON object

Loading...

CVEs (7,447)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-9111
1Citrix
1Receiver Desktop
May 6, 2026
Nov 7, 2016
N/A· v4
6.8 MEDIUM· v3
4.6 MEDIUM· v2
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE:...Show more
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208, the vendor could not reproduce the issue, stating "the researcher was unable to provide us with information that would allow us to confirm the behaviour and, despite extensive investigation on test deployments of supported products, we were unable to reproduce the behaviour as he described. The researcher has also, despite additional requests for information, ceased to respond to us."Show less
CVE-2016-9190
2Debian
Python
2Debian Linux
Pillow
May 6, 2026
Nov 4, 2016
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.
CVE-2016-9182
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 4, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits un...Show more
Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized method name to bypass the permission check, e.g., controller=expHTMLEditor&action=preview&editor=ckeditor and controller=expHTMLEditor&action=Preview&editor=ckeditor. An anonymous user will be rejected for the former but can access the latter.Show less
CVE-2016-3060
1Ibm
1Financial Transaction Manager
May 6, 2026
Oct 29, 2016
N/A· v4
5.7 MEDIUM· v3
3.5 LOW· v2
Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to c...Show more
Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.Show less
CVE-2016-8580
1Alienvault
2Open Source Security Information And Event Management
Unified Security Management
May 6, 2026
Oct 28, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
CVE-2016-8296
1Oracle
1Peoplesoft Enterprise Peopletools
May 6, 2026
Oct 25, 2016
N/A· v4
7.6 HIGH· v3
4.9 MEDIUM· v2
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to LD...Show more
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to LDAP.Show less
CVE-2016-8293
1Oracle
1Peoplesoft Enterprise Peopletools
May 6, 2026
Oct 25, 2016
N/A· v4
8.2 HIGH· v3
5.8 MEDIUM· v2
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration...Show more
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5529 and CVE-2016-5530.Show less
CVE-2016-8292
1Oracle
1Peoplesoft Enterprise Human Capital Management Talent Acquisition Manager
May 6, 2026
Oct 25, 2016
N/A· v4
4.2 MEDIUM· v3
5.8 MEDIUM· v2
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition M...Show more
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition Manager.Show less
CVE-2016-8291
1Oracle
1Peoplesoft Enterprise Peopletools
May 6, 2026
Oct 25, 2016
N/A· v4
8.2 HIGH· v3
5.8 MEDIUM· v2
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Appli...Show more
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Application Platform.Show less
CVE-2016-8288
1Oracle
1Mysql
May 6, 2026
Oct 25, 2016
N/A· v4
3.1 LOW· v3
4.9 MEDIUM· v2
Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.
CVE-2016-8285
1Oracle
1Peoplesoft Enterprise Human Capital Management Candidate Gateway
May 6, 2026
Oct 25, 2016
N/A· v4
4.8 MEDIUM· v3
4.9 MEDIUM· v2
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality and integrity via vectors related to Candidate Gateway.
CVE-2016-8281
1Oracle
1Platform Security For Java
May 6, 2026
Oct 25, 2016
N/A· v4
7.6 HIGH· v3
6.5 MEDIUM· v2
Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and...Show more
Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-5536.Show less
CVE-2016-5622
1Oracle
1Flexcube Universal Banking
May 6, 2026
Oct 25, 2016
N/A· v4
6.1 MEDIUM· v3
7.8 HIGH· v2
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote attackers to affect confident...Show more
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote attackers to affect confidentiality and integrity via vectors related to INFRA.Show less
CVE-2016-5621
1Oracle
1Flexcube Universal Banking
May 6, 2026
Oct 25, 2016
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 and 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect con...Show more
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 and 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality via vectors related to INFRA, a different vulnerability than CVE-2016-5603.Show less
CVE-2016-5620
1Oracle
1Flexcube Universal Banking
May 6, 2026
Oct 25, 2016
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect...Show more
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to INFRA, a different vulnerability than CVE-2016-5619.Show less
CVE-2016-5619
1Oracle
1Flexcube Universal Banking
May 6, 2026
Oct 25, 2016
N/A· v4
8.1 HIGH· v3
5.5 MEDIUM· v2
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect...Show more
Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to INFRA, a different vulnerability than CVE-2016-5620.Show less
CVE-2016-5615
1Oracle
1Solaris
May 6, 2026
Oct 25, 2016
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx.
CVE-2016-5613
1Oracle
1Vm Virtualbox
May 6, 2026
Oct 25, 2016
N/A· v4
4.3 MEDIUM· v3
2.1 LOW· v2
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerabili...Show more
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5608.Show less
CVE-2016-5610
1Oracle
1Vm Virtualbox
May 6, 2026
Oct 25, 2016
N/A· v4
6.8 MEDIUM· v3
4.6 MEDIUM· v2
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related...Show more
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core.Show less
CVE-2016-5608
1Oracle
1Vm Virtualbox
May 6, 2026
Oct 25, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerabili...Show more
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5613.Show less