CWE-254 · 379 records
7PK - Security Features
CVEs in this class
379 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
56Plan | CVE-2016-2296Weaponized | Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remmeteocontrol · web\'log basic 100 · CWE-254 | Critical9.4 | — | 64.2% | May 14, 2016 |
49Plan | CVE-2015-1158Proof of concept | The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-cups · cups · CWE-254 | Critical10.0 | — | 29.7% | Jun 26, 2015 |
47Plan | CVE-2016-0161No exploit | Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege microsoft · edge · CWE-254 | Medium6.5 | — | 68.7% | Apr 12, 2016 |
44Plan | CVE-2015-1793Weaponized | The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic openssl · openssl · CWE-254 | Medium6.5 | — | 58.4% | Jul 9, 2015 |
43Plan | CVE-2016-3238Proof of concept | The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201microsoft · windows 10 · CWE-254 | High8.1 | — | 35.4% | Jul 12, 2016 |
41Plan | CVE-2016-2118Proof of concept | The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCsamba · samba · CWE-254 | High7.5 | — | 36.9% | Apr 12, 2016 |
41Plan | CVE-2016-10178No exploit | An issue was discovered on the D-Link DWR-932B router.dlink · dwr-932b firmware · CWE-254 | Critical9.8 | — | 7.5% | Jan 30, 2017 |
41Plan | CVE-2016-6957No exploit | Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-254 | Critical9.8 | — | 5.8% | Oct 13, 2016 |
41Plan | CVE-2016-4215No exploit | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-254 | Critical9.8 | — | 5.7% | Jul 12, 2016 |
41Plan | CVE-2014-5334No exploit | FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.freenas · freenas · CWE-254 | Critical9.8 | — | 5.0% | Jan 8, 2018 |
41Plan | CVE-2015-3972No exploit | The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easiejanitza · umg 508 · CWE-254 | Critical10.0 | — | 2.8% | Oct 28, 2015 |
41Plan | CVE-2016-5788No exploit | General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it ge · bently nevada 3500\/22m usb firmware · CWE-254 | Critical10.0 | — | 2.3% | Nov 24, 2016 |
40Plan | CVE-2015-8286No exploit | Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP porzhuhai · raysharp firmware · CWE-254 | Critical9.8 | — | 4.5% | Feb 18, 2016 |
40Plan | CVE-2015-8803No exploit | The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its nettle project · nettle · CWE-254 | Critical9.8 | — | 4.2% | Feb 23, 2016 |
40Plan | CVE-2015-7554No exploit | The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or libtiff · libtiff · CWE-254 | Critical9.8 | — | 4.1% | Jan 8, 2016 |
40Plan | CVE-2017-8227No exploit | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are deamcrest · ipm-721s firmware · CWE-254 | Critical9.8 | — | 4.1% | Jul 3, 2019 |
40Plan | CVE-2015-8804No exploit | x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation nettle project · nettle · CWE-254 | Critical9.8 | — | 3.9% | Feb 23, 2016 |
40Plan | CVE-2015-8857No exploit | The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which muglifyjs project · uglifyjs · CWE-254 | Critical9.8 | — | 3.5% | Jan 23, 2017 |
40Plan | CVE-2015-6473No exploit | WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.wago · 750-849 firmware · CWE-254 | Critical9.8 | — | 3.5% | Aug 22, 2017 |
40Plan | CVE-2016-1896No exploit | Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.0lexmark · printer firmware · CWE-254 | Critical9.8 | — | 3.2% | Jan 27, 2016 |
40Plan | CVE-2016-6629No exploit | An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive.phpmyadmin · phpmyadmin · CWE-254 | Critical9.8 | — | 3.2% | Dec 10, 2016 |
40Plan | CVE-2011-4889No exploit | The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before ibm · websphere application server · CWE-254 | Critical9.8 | — | 2.6% | Feb 8, 2018 |
40Plan | CVE-2016-10321No exploit | web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-forweb2py · web2py · CWE-254 | Critical9.8 | — | 2.6% | Apr 10, 2017 |
40Plan | CVE-2016-0332No exploit | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed libm · security identity manager virtual appliance · CWE-254 | Critical9.8 | — | 2.2% | Jan 12, 2018 |
40Plan | CVE-2016-9865No exploit | An issue was discovered in phpMyAdmin.phpmyadmin · phpmyadmin · CWE-254 | Critical9.8 | — | 2.2% | Dec 10, 2016 |
- CVE-2016-229656Plan
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows rem
CriticalCVSS 9.4WeaponizedEPSS 64%meteocontrol · web\'log basic 100May 14, 2016
- CVE-2015-115849Plan
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-
CriticalCVSS 10.0Proof of conceptEPSS 29%cups · cupsJun 26, 2015
- CVE-2016-016147Plan
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege
MediumCVSS 6.5No exploitEPSS 68%microsoft · edgeApr 12, 2016
- CVE-2015-179344Plan
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic
MediumCVSS 6.5WeaponizedEPSS 58%openssl · opensslJul 9, 2015
- CVE-2016-323843Plan
The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201
HighCVSS 8.1Proof of conceptEPSS 35%microsoft · windows 10Jul 12, 2016
- CVE-2016-211841Plan
The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DC
HighCVSS 7.5Proof of conceptEPSS 36%samba · sambaApr 12, 2016
- CVE-2016-1017841Plan
An issue was discovered on the D-Link DWR-932B router.
CriticalCVSS 9.8No exploitEPSS 7%dlink · dwr-932b firmwareJan 30, 2017
- CVE-2016-695741Plan
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8No exploitEPSS 5%adobe · acrobatOct 13, 2016
- CVE-2016-421541Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8No exploitEPSS 5%adobe · acrobatJul 12, 2016
- CVE-2014-533441Plan
FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login.
CriticalCVSS 9.8No exploitEPSS 5%freenas · freenasJan 8, 2018
- CVE-2015-397241Plan
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easie
CriticalCVSS 10.0No exploitEPSS 2%janitza · umg 508Oct 28, 2015
- CVE-2016-578841Plan
General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it
CriticalCVSS 10.0No exploitEPSS 2%ge · bently nevada 3500\/22m usb firmwareNov 24, 2016
- CVE-2015-828640Plan
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP por
CriticalCVSS 9.8No exploitEPSS 4%zhuhai · raysharp firmwareFeb 18, 2016
- CVE-2015-880340Plan
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its
CriticalCVSS 9.8No exploitEPSS 4%nettle project · nettleFeb 23, 2016
- CVE-2015-755440Plan
The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or
CriticalCVSS 9.8No exploitEPSS 4%libtiff · libtiffJan 8, 2016
- CVE-2017-822740Plan
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are de
CriticalCVSS 9.8No exploitEPSS 4%amcrest · ipm-721s firmwareJul 3, 2019
- CVE-2015-880440Plan
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation
CriticalCVSS 9.8No exploitEPSS 3%nettle project · nettleFeb 23, 2016
- CVE-2015-885740Plan
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which m
CriticalCVSS 9.8No exploitEPSS 3%uglifyjs project · uglifyjsJan 23, 2017
- CVE-2015-647340Plan
WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.
CriticalCVSS 9.8No exploitEPSS 3%wago · 750-849 firmwareAug 22, 2017
- CVE-2016-189640Plan
Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.0
CriticalCVSS 9.8No exploitEPSS 3%lexmark · printer firmwareJan 27, 2016
- CVE-2016-662940Plan
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive.
CriticalCVSS 9.8No exploitEPSS 3%phpmyadmin · phpmyadminDec 10, 2016
- CVE-2011-488940Plan
The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before
CriticalCVSS 9.8No exploitEPSS 2%ibm · websphere application serverFeb 8, 2018
- CVE-2016-1032140Plan
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-for
CriticalCVSS 9.8No exploitEPSS 2%web2py · web2pyApr 10, 2017
- CVE-2016-033240Plan
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed l
CriticalCVSS 9.8No exploitEPSS 2%ibm · security identity manager virtual applianceJan 12, 2018
- CVE-2016-986540Plan
An issue was discovered in phpMyAdmin.
CriticalCVSS 9.8No exploitEPSS 2%phpmyadmin · phpmyadminDec 10, 2016