Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (8,728)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-9005 1Ibm 1System Storage Ts3100 Ts3200 Tape Library May 13, 2026 Feb 8, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
CVE-2016-0308 1Ibm 1Connections May 13, 2026 Feb 8, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.
CVE-2016-0214 1Ibm 1Bigfix Platform May 13, 2026 Feb 8, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be throug...Show more IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file.Show less
CVE-2015-7494 1Ibm 2Cloud Orchestrator Smartcloud Orchestrator May 13, 2026 Feb 8, 2017 N/A· v4 2.8 LOW· v3 1.7 LOW· v2 A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it wou...Show more A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.Show less
CVE-2015-1976 1Ibm 2Security Directory Server Tivoli Directory Server May 13, 2026 Feb 8, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash.
CVE-2016-8418 1Google 1Android May 13, 2026 Feb 8, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of rem...Show more A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the context of the kernel. Product: Android. Versions: N/A. Android ID: A-32652894. References: QC-CR#1077457.Show less
CVE-2016-9639 1Saltstack 1Salt May 13, 2026 Feb 7, 2017 N/A· v4 9.1 CRITICAL· v3 7.5 HIGH· v2 Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
CVE-2016-1894 1Netapp 1Oncommand Workflow Automation May 13, 2026 Feb 7, 2017 N/A· v4 8.1 HIGH· v3 9.3 HIGH· v2 NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors.
CVE-2016-3020 1Ibm 4Security Access Manager 9.0 Firmware Security Access Manager For MobileSecurity Access Manager For Web 7.0 Firmware+1 more May 13, 2026 Feb 7, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validation. By persuading a victim to open specially-crafted content,...Show more IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validation. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to bypass validation and load a page with malicious content.Show less
CVE-2016-6095 1Ibm 1Security Key Lifecycle Manager May 13, 2026 Feb 2, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVE-2016-9008 1Ibm 1Urbancode Deploy May 13, 2026 Feb 1, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent.
CVE-2016-8938 1Ibm 1Urbancode Deploy May 13, 2026 Feb 1, 2017 N/A· v4 10.0 CRITICAL· v3 10.0 HIGH· v2 IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production a...Show more IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications.Show less
CVE-2016-8932 1Ibm 1Kenexa Lms May 13, 2026 Feb 1, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVE-2016-8931 1Ibm 1Kenexa Lms May 13, 2026 Feb 1, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVE-2016-2942 1Ibm 1Urbancode Deploy May 13, 2026 Feb 1, 2017 N/A· v4 7.5 HIGH· v3 6.0 MEDIUM· v2 IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent machine.
CVE-2016-0320 1Ibm 1Urbancode Deploy May 13, 2026 Feb 1, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered pro...Show more IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes.Show less
CVE-2016-6105 1Ibm 1Security Key Lifecycle Manager May 13, 2026 Feb 1, 2017 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas.
CVE-2016-8942 1Ibm 2Spectrum Control Tivoli Storage Productivity Center May 13, 2026 Feb 1, 2017 N/A· v4 3.1 LOW· v3 3.5 LOW· v2 IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the server.
CVE-2016-6085 1Ibm 1Bigfix Platform May 13, 2026 Feb 1, 2017 N/A· v4 6.5 MEDIUM· v3 3.3 LOW· v2 IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.
CVE-2016-6044 1Ibm 1Tivoli Storage Manager May 13, 2026 Feb 1, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy.

Previous 1...402403404...437 Next