Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (8,728)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-4850 1Linecorp 1Line May 13, 2026 Apr 20, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
CVE-2016-1220 1Cybozu 1Garoon May 13, 2026 Apr 20, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Cybozu Garoon before 4.2.2 does not properly restrict access.
CVE-2016-6338 1Redhat 1Enterprise Virtualization May 13, 2026 Apr 20, 2017 N/A· v4 6.8 MEDIUM· v3 4.6 MEDIUM· v2 ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors rela...Show more ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.Show less
CVE-2016-6337 1Mediawiki 1Mediawiki May 13, 2026 Apr 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
CVE-2016-6336 1Mediawiki 1Mediawiki May 13, 2026 Apr 20, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revi...Show more MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.Show less
CVE-2016-6331 1Mediawiki 1Mediawiki May 13, 2026 Apr 20, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
CVE-2016-4874 1Cybozu 1Office May 13, 2026 Apr 17, 2017 N/A· v4 3.5 LOW· v3 3.5 LOW· v2 Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
CVE-2016-7032 1Todd Miller 1Sudo May 13, 2026 Apr 14, 2017 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
CVE-2016-4032 1Samsung 5Galaxy Note 3 Firmware Galaxy S4 FirmwareGalaxy S4 Mini Firmware+2 more May 13, 2026 Apr 13, 2017 N/A· v4 4.6 MEDIUM· v3 2.1 LOW· v2 Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUH...Show more Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUHOJ2 (Galaxy S4) devices do not block AT+USBDEBUG and AT+WIFIVALUE, which allows attackers to modify Android settings by leveraging AT access, aka SVE-2016-5301.Show less
CVE-2016-4031 1Samsung 5Galaxy Note 3 Firmware Galaxy S4 FirmwareGalaxy S4 Mini Firmware+2 more May 13, 2026 Apr 13, 2017 N/A· v4 6.8 MEDIUM· v3 4.6 MEDIUM· v2 Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUH...Show more Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUHOJ2 (Galaxy S4) devices allow attackers to send AT commands by plugging the device into a Linux host, aka SVE-2016-5301.Show less
CVE-2016-4030 1Samsung 5Galaxy Note 3 Firmware Galaxy S4 FirmwareGalaxy S4 Mini Firmware+2 more May 13, 2026 Apr 13, 2017 N/A· v4 6.8 MEDIUM· v3 4.6 MEDIUM· v2 Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUH...Show more Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUHOJ2 (Galaxy S4) devices have unintended availability of the modem in USB configuration number 2 within the secure lockscreen state, allowing an attacker to make phone calls, send text messages, or issue commands, aka SVE-2016-5301.Show less
CVE-2016-6143 1Sap 1Hana May 13, 2026 Apr 13, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806.
CVE-2016-4800 1Eclipse 1Jetty May 13, 2026 Apr 13, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certai...Show more The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.Show less
CVE-2015-8284 1Seawell Networks 1Spectrum Sdc May 13, 2026 Apr 13, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
CVE-2016-1178 1Appleple 1A Blog Cms May 13, 2026 Apr 12, 2017 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors.
CVE-2016-6605 1Cloudera 1Cdh May 13, 2026 Apr 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
CVE-2016-5058 1Osram 1Lightify Pro May 13, 2026 Apr 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.
CVE-2016-5054 1Osram 1Lightify Home May 13, 2026 Apr 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.
CVE-2015-8275 1Eparaksts 2Edoc Libraries Eparakstitajs 3 May 13, 2026 Apr 10, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
CVE-2015-7265 1Proxygen Project 1Proxygen May 13, 2026 Apr 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.

Previous 1...398399400...437 Next