Vulnerabilities > Permissions, Privileges, and Access Controls

DATE CVE VULNERABILITY TITLE RISK
2016-03-09 CVE-2016-0093 Permissions, Privileges, and Access Controls vulnerability in Microsoft products
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0094, CVE-2016-0095, and CVE-2016-0096.
local
low complexity
microsoft CWE-264
7.8
2016-03-09 CVE-2016-0087 Permissions, Privileges, and Access Controls vulnerability in Microsoft Windows 7, Windows Server 2008 and Windows Vista
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
local
low complexity
microsoft CWE-264
7.8
2016-03-09 CVE-2016-0057 Permissions, Privileges, and Access Controls vulnerability in Microsoft Office
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka "Microsoft Office Security Feature Bypass Vulnerability."
local
low complexity
microsoft CWE-264
7.8
2016-03-06 CVE-2016-1636 Permissions, Privileges, and Access Controls vulnerability in Google Chrome
The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.
network
low complexity
google CWE-264
critical
9.8
2016-03-06 CVE-2016-1632 Permissions, Privileges, and Access Controls vulnerability in Google Chrome
The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.
network
low complexity
google CWE-264
8.8
2016-03-06 CVE-2016-1631 Permissions, Privileges, and Access Controls vulnerability in Google Chrome
The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
network
low complexity
google CWE-264
8.8
2016-03-06 CVE-2016-1630 Permissions, Privileges, and Access Controls vulnerability in Google Chrome
The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site.
network
low complexity
google CWE-264
8.8
2016-02-29 CVE-2015-7455 Permissions, Privileges, and Access Controls vulnerability in IBM Websphere Portal
IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI.
network
high complexity
ibm CWE-264
3.1
2016-02-28 CVE-2016-2521 Permissions, Privileges, and Access Controls vulnerability in Wireshark
Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
local
low complexity
wireshark CWE-264
7.8
2016-02-25 CVE-2016-0763 Permissions, Privileges, and Access Controls vulnerability in multiple products
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
network
low complexity
debian apache canonical CWE-264
6.3