Vulnerabilities (CVE)

Filtered by CWE-264
Total 5244 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2014-8655 1 Compal Broadband Networks 3 Cg6640e Wireless Gateway, Ch664oe Wireless Gateway, Firmware 2025-04-12 5.0 MEDIUM N/A
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to bypass authentication and obtain sensitive information via an (a) admin or a (b) root value in the userData cookie in a request to (1) CmgwWirelessSecurity.xml, (2) DocsisConfigFile.xml, or (3) CmgwBasicSetup.xml in xml/ or (4) basicDDNS.html, (5) basicLanUsers.html, or (6) rootDesc.xml.
CVE-2014-4624 1 Avamar Virtual Edition 4 6.0, 6.0.402, 7.0 and 1 more 2025-04-12 5.0 MEDIUM N/A
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.
CVE-2015-0214 1 Moodle 1 Moodle 2025-04-12 4.0 MEDIUM N/A
message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.
CVE-2015-0554 1 Adb 2 P.dga4001n, P.dga4001n Firmware 2025-04-12 9.4 HIGH N/A
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.
CVE-2015-1029 1 Puppet 2 Puppet Enterprise, Stdlib 2025-04-12 6.5 MEDIUM N/A
The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.
CVE-2016-6741 1 Google 1 Android 2025-04-12 9.3 HIGH 7.8 HIGH
An elevation of privilege vulnerability in the Qualcomm camera driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Android ID: A-30559423. References: Qualcomm QC-CR#1060554.
CVE-2016-6673 1 Google 1 Android 2025-04-12 9.3 HIGH 7.8 HIGH
The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 30204201.
CVE-2015-7455 1 Ibm 1 Websphere Portal 2025-04-12 4.0 MEDIUM 3.1 LOW
IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI.
CVE-2016-0196 1 Microsoft 7 Windows 10, Windows 7, Windows 8.1 and 4 more 2025-04-12 7.2 HIGH 7.8 HIGH
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0173, and CVE-2016-0174.
CVE-2016-0905 1 Emc 1 Avamar Server 2025-04-12 7.2 HIGH 6.7 MEDIUM
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.
CVE-2014-5020 1 Drupal 1 Drupal 2025-04-12 4.9 MEDIUM N/A
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
CVE-2014-9226 2 Broadcom, Symantec 2 Symantec Critical System Protection, Data Center Security 2025-04-12 7.2 HIGH N/A
The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows local users to bypass intended Protection Policies via unspecified vectors.
CVE-2016-5654 1 Misys 1 Fusioncapital Opics Plus 2025-04-12 8.5 HIGH 7.5 HIGH
Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter.
CVE-2013-5356 1 Sharetronix 1 Sharetronix 2025-04-12 7.5 HIGH N/A
Sharetronix 3.1.1.3, 3.1.1, and earlier does not properly restrict access to unspecified AJAX functionality, which allows remote attackers to bypass authentication via unknown vectors.
CVE-2016-2410 1 Google 1 Android 2025-04-12 6.9 MEDIUM 7.4 HIGH
A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677.
CVE-2015-7600 1 Cisco 1 Vpn Client 2025-04-12 7.2 HIGH N/A
Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
CVE-2015-5715 1 Wordpress 1 Wordpress 2025-04-12 4.0 MEDIUM 4.3 MEDIUM
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
CVE-2015-8955 2 Google, Linux 2 Android, Linux Kernel 2025-04-12 6.9 MEDIUM 7.3 HIGH
arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.
CVE-2014-0877 1 Ibm 1 Cognos Tm1 2025-04-12 5.0 MEDIUM N/A
IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restrictions by visiting the Rights page and then following a generated link.
CVE-2015-2528 1 Microsoft 9 Windows 10, Windows 7, Windows 8 and 6 more 2025-04-12 7.2 HIGH N/A
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2524.