Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (7,447)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-0760 1Apache 1Sentry May 6, 2026 Aug 19, 2016 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.
CVE-2016-3319 1Microsoft 4Edge Windows 10Windows 8.1+1 more May 6, 2026 Aug 9, 2016 N/A· v4 7.0 HIGH· v3 9.3 HIGH· v2 The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote...Show more The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."Show less
CVE-2016-3299 1Microsoft 7Windows 10 Windows 7Windows 8.1+4 more May 6, 2026 Aug 9, 2016 N/A· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to hijack network traffic...Show more Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to hijack network traffic or bypass intended Enhanced Protected Mode (EPM) or application container protection mechanisms, and consequently render untrusted content in a browser, by leveraging how NetBIOS validates responses, aka "NetBIOS Spoofing Vulnerability."Show less
CVE-2016-2989 1Ibm 1Connections Portlets May 6, 2026 Aug 8, 2016 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 Open redirect vulnerability in the Connections Portlets component 5.x before 5.0.2 for IBM WebSphere Portal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified ve...Show more Open redirect vulnerability in the Connections Portlets component 5.x before 5.0.2 for IBM WebSphere Portal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.Show less
CVE-2016-2960 1Ibm 1Websphere Application Server May 6, 2026 Aug 8, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attack...Show more IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages.Show less
CVE-2016-1474 1Cisco 1Prime Infrastructure May 6, 2026 Aug 8, 2016 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, relate...Show more Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuw65846, a different vulnerability than CVE-2015-6434.Show less
CVE-2015-3854 1Google 1Android May 6, 2026 Aug 7, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka in...Show more packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.Show less
CVE-2016-5144 1Google 1Chrome May 6, 2026 Aug 7, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attack...Show more The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.Show less
CVE-2016-6198 2Linux Oracle 3Linux Linux KernelVm Server May 6, 2026 Aug 6, 2016 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a...Show more The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.Show less
CVE-2014-9865 1Google 1Android May 6, 2026 Aug 6, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly restrict user-space input, which allows attackers to gain privileges via a crafted applicat...Show more drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly restrict user-space input, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28748271 and Qualcomm internal bug CR550013.Show less
CVE-2016-3839 1Google 1Android May 6, 2026 Aug 5, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of Bluetooth 911 functionality) via a crafted application that...Show more Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of Bluetooth 911 functionality) via a crafted application that sends a signal to a Bluetooth process, aka internal bug 28885210.Show less
CVE-2016-3838 1Google 1Android May 6, 2026 Aug 5, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted application that uses the app-pinning feature, aka internal bug 28761672.
CVE-2014-9901 1Google 1Android May 6, 2026 Aug 5, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attackers to cause a denial of service (device hang or reboot) via crafted frames, aka...Show more The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attackers to cause a denial of service (device hang or reboot) via crafted frames, aka Android internal bug 28670333 and Qualcomm internal bug CR548711.Show less
CVE-2016-6150 1Sap 1Hana May 6, 2026 Aug 5, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknow...Show more The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.Show less
CVE-2016-6144 1Sap 1Hana May 6, 2026 Aug 5, 2016 N/A· v4 8.1 HIGH· v3 4.3 MEDIUM· v2 The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier...Show more The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.Show less
CVE-2016-6140 1Sap 1Trex May 6, 2026 Aug 5, 2016 N/A· v4 9.8 CRITICAL· v3 7.6 HIGH· v2 SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591.
CVE-2016-6258 2Citrix Xen 2Xen Xenserver May 6, 2026 Aug 2, 2016 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.
CVE-2016-5229 1Atlassian 1Bamboo May 6, 2026 Aug 2, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.
CVE-2016-4373 1Hp 1Operations Manager May 6, 2026 Aug 1, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections...Show more The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.Show less
CVE-2016-1608 1Novell 1Filr May 6, 2026 Aug 1, 2016 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter.

Previous 1...353354355...373 Next