Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (8,728)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-8309 1Oracle 1Flexcube Investor Servicing May 13, 2026 Jan 27, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 12.0.1, 12.0.2,12.0.4,12.1.0 and 12.3.0. Easily e...Show more Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 12.0.1, 12.0.2,12.0.4,12.1.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS v3.0 Base Score 4.3 (Confidentiality impacts).Show less
CVE-2016-8307 1Oracle 1Flexcube Universal Banking May 13, 2026 Jan 27, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and...Show more Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 5.3 (Confidentiality impacts).Show less
CVE-2016-8304 1Oracle 1Flexcube Universal Banking May 13, 2026 Jan 27, 2017 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and...Show more Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 5.4 (Confidentiality and Integrity impacts).Show less
CVE-2016-8300 1Oracle 1Flexcube Private Banking May 13, 2026 Jan 27, 2017 N/A· v4 5.3 MEDIUM· v3 3.5 LOW· v2 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Diff...Show more Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 5.3 (Confidentiality impacts).Show less
CVE-2016-8299 1Oracle 1Flexcube Universal Banking May 13, 2026 Jan 27, 2017 N/A· v4 6.3 MEDIUM· v3 6.5 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and...Show more Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).Show less
CVE-2016-8298 1Oracle 1Flexcube Private Banking May 13, 2026 Jan 27, 2017 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easi...Show more Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 8.1 (Confidentiality and Integrity impacts).Show less
CVE-2016-8297 1Oracle 1Flexcube Universal Banking May 13, 2026 Jan 27, 2017 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and...Show more Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 8.1 (Confidentiality and Integrity impacts).Show less
CVE-2016-8282 1Oracle 1Flexcube Private Banking May 13, 2026 Jan 27, 2017 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easi...Show more Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).Show less
CVE-2016-1920 1Samsung 1Knox May 13, 2026 Jan 27, 2017 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service.
CVE-2016-8227 1Lenovo 1Transition May 13, 2026 Jan 26, 2017 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute code with elevated privileges.
CVE-2016-7792 1Ubiquiti Networks 1Unifi Ap Ac Lite Firmware May 13, 2026 Jan 23, 2017 N/A· v4 8.8 HIGH· v3 8.3 HIGH· v2 Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it.
CVE-2014-8362 1Vivint 1Sky Control Panel Firmware May 13, 2026 Jan 23, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interface.
CVE-2016-8643 1Moodle 1Moodle May 13, 2026 Jan 20, 2017 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
CVE-2016-8642 1Moodle 1Moodle May 13, 2026 Jan 20, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
CVE-2016-9016 1Firejail Project 1Firejail May 13, 2026 Jan 19, 2017 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
CVE-2016-7794 1Sociomantic 1Git Hub May 13, 2026 Jan 19, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name.
CVE-2016-7793 1Sociomantic 1Git Hub May 13, 2026 Jan 19, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL.
CVE-2016-7545 3Fedoraproject RedhatSelinux Project 7Enterprise Linux Desktop Enterprise Linux Hpc NodeEnterprise Linux Server+4 more May 13, 2026 Jan 19, 2017 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
CVE-2016-5217 1Google 1Chrome May 13, 2026 Jan 19, 2017 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolat...Show more The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page.Show less
CVE-2016-5206 1Google 1Chrome May 13, 2026 Jan 19, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafte...Show more The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.Show less

Previous 1...404405406...437 Next