CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (Bypass)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-7444 264 Bypass 2016-09-27 2016-09-28
5.0
None Remote Low Not required None Partial None
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
2 CVE-2016-7191 287 Bypass 2016-09-28 2016-09-29
4.3
None Remote Medium Not required Partial None None
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
3 CVE-2016-7114 287 Bypass 2016-09-05 2016-09-06
9.0
None Remote Low Single system Complete Complete Complete
The EN100 Ethernet module before 4.29 for Siemens SIPROTEC 4 and SIPROTEC Compact devices allows remote attackers to bypass authentication and obtain administrative access via unspecified HTTP traffic during an authenticated session.
4 CVE-2016-7112 287 Bypass 2016-09-05 2016-09-06
10.0
Admin Remote Low Not required Complete Complete Complete
The EN100 Ethernet module before 4.29 for Siemens SIPROTEC 4 and SIPROTEC Compact devices allows remote attackers to bypass authentication and obtain administrative access via unspecified HTTP traffic.
5 CVE-2016-7098 362 Bypass 2016-09-26 2016-09-28
6.8
None Remote Medium Not required Partial Partial Partial
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.
6 CVE-2016-7034 352 Bypass CSRF 2016-09-07 2016-09-08
6.8
None Remote Medium Not required Partial Partial Partial
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF protection mechanisms or (2) conduct cross-site request forgery (CSRF) attacks by obtaining an old token.
7 CVE-2016-6802 284 Bypass 2016-09-20 2016-09-21
5.0
None Remote Low Not required None Partial None
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
8 CVE-2016-6662 264 Exec Code Bypass 2016-09-20 2016-09-21
10.0
None Remote Low Not required Complete Complete Complete
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib.
9 CVE-2016-6536 264 Bypass 2016-09-18 2016-09-19
10.0
None Remote Low Not required Complete Complete Complete
The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
10 CVE-2016-6411 20 Bypass 2016-09-23 2016-09-27
5.0
None Remote Low Not required None Partial None
Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers to bypass intended do-not-decrypt settings via a crafted URL, aka Bug ID CSCva50585.
11 CVE-2016-6405 20 Bypass 2016-09-18 2016-09-19
6.8
None Remote Low Single system None Complete None
Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.
12 CVE-2016-6396 20 Bypass 2016-09-12 2016-09-12
5.0
None Remote Low Not required None Partial None
Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, allow remote attackers to bypass malware detection via crafted fields in HTTP headers, aka Bug ID CSCuz44482.
13 CVE-2016-6377 287 Bypass 2016-09-03 2016-09-06
6.8
None Remote Medium Not required Partial Partial Partial
Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitrary Platform and Applications Manager (PAM) API calls via unspecified vectors, aka Bug ID CSCuz52110.
14 CVE-2016-6364 200 Bypass +Info 2016-08-22 2016-08-23
5.0
None Remote Low Not required Partial None None
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855.
15 CVE-2016-6317 284 Bypass 2016-09-07 2016-09-08
5.0
None Remote Low Not required None Partial None
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
16 CVE-2016-6212 200 Bypass +Info 2016-09-09 2016-09-09
5.0
None Remote Low Not required Partial None None
The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.
17 CVE-2016-6159 287 Bypass 2016-09-21 2016-09-22
6.8
None Local Network High Not required Complete Complete Complete
The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentication and obtain administrative access by sending "special packages" to the LAN interface.
18 CVE-2016-6150 284 Bypass 2016-08-05 2016-08-10
7.5
None Remote Low Not required Partial Partial Partial
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.
19 CVE-2016-6144 284 Bypass 2016-08-05 2016-08-05
4.3
None Remote Medium Not required Partial None None
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.
20 CVE-2016-6136 362 Bypass 2016-08-06 2016-08-10
1.9
None Local Medium Not required None Partial None
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
21 CVE-2016-5943 284 Bypass 2016-09-26 2016-09-27
5.5
None Remote Low Single system Partial Partial None
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass intended access restrictions, and read task details or edit properties, via unspecified vectors.
22 CVE-2016-5839 Bypass 2016-06-29 2016-07-29
5.0
None Remote Low Not required None Partial None
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
23 CVE-2016-5838 255 Bypass 2016-06-29 2016-07-29
5.0
None Remote Low Not required None Partial None
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
24 CVE-2016-5837 Bypass 2016-06-29 2016-08-01
5.0
None Remote Low Not required None Partial None
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
25 CVE-2016-5832 Bypass 2016-06-29 2016-08-02
5.0
None Remote Low Not required None Partial None
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
26 CVE-2016-5807 284 Bypass 2016-07-15 2016-07-18
5.5
None Remote Low Single system Partial Partial None
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request.
27 CVE-2016-5804 287 Bypass 2016-07-15 2016-07-19
5.0
None Remote Low Not required Partial None None
Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.
28 CVE-2016-5790 Bypass 2016-07-15 2016-07-18
5.0
None Remote Low Not required None None Partial
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors.
29 CVE-2016-5668 Bypass 2016-08-02 2016-08-15
7.5
None Remote Low Not required Partial Partial Partial
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
30 CVE-2016-5667 Bypass 2016-08-02 2016-08-15
7.5
None Remote Low Not required Partial Partial Partial
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.
31 CVE-2016-5637 119 DoS Exec Code Overflow Bypass 2016-07-15 2016-07-18
6.8
None Remote Medium Not required Partial Partial Partial
The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a "type confusion" issue.
32 CVE-2016-5419 310 Bypass 2016-08-10 2016-08-12
5.0
None Remote Low Not required Partial None None
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
33 CVE-2016-5363 254 DoS Bypass 2016-06-17 2016-06-20
6.4
None Remote Low Not required Partial None Partial
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
34 CVE-2016-5362 254 DoS Bypass 2016-06-17 2016-06-21
6.4
None Remote Low Not required Partial None Partial
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
35 CVE-2016-5340 20 Bypass 2016-08-07 2016-08-11
7.2
None Local Low Not required Complete Complete Complete
The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.
36 CVE-2016-5283 284 Bypass 2016-09-22 2016-09-23
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.
37 CVE-2016-5265 79 XSS Bypass 2016-08-04 2016-09-28
4.0
None Remote High Not required Partial Partial None
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.
38 CVE-2016-5247 254 Bypass 2016-09-22 2016-09-23
7.2
None Local Low Not required Complete Complete Complete
The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240, TS440, and TS540 devices; and ThinkStation E32, P300, and P310 devices might allow local users or physically proximate attackers to bypass the Secure Boot protection mechanism by leveraging an AMI test key.
39 CVE-2016-5176 284 Bypass 2016-09-29 2016-09-29
4.3
None Remote Medium Not required None Partial None
Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors.
40 CVE-2016-5173 284 Bypass 2016-09-25 2016-09-27
6.8
None Remote Medium Not required Partial Partial Partial
The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.
41 CVE-2016-5145 254 Bypass 2016-08-07 2016-08-10
6.8
None Remote Medium Not required Partial Partial Partial
Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
42 CVE-2016-5144 284 Bypass 2016-08-07 2016-08-10
7.5
None Remote Low Not required Partial Partial Partial
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.
43 CVE-2016-5143 264 Bypass 2016-08-07 2016-08-10
7.5
None Remote Low Not required Partial Partial Partial
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144.
44 CVE-2016-5135 20 Bypass 2016-07-23 2016-07-27
4.3
None Remote Medium Not required None Partial None
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element.
45 CVE-2016-5132 254 Bypass 2016-07-23 2016-07-27
6.8
None Remote Medium Not required Partial Partial Partial
The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.
46 CVE-2016-5128 254 Bypass 2016-07-23 2016-07-28
6.8
None Remote Medium Not required Partial Partial Partial
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
47 CVE-2016-5109 284 Bypass 2016-07-13 2016-07-14
2.1
None Local Low Not required None Partial None
Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Apple Touch ID authentication via unspecified vectors, related to an application requiring re-authentication.
48 CVE-2016-5104 284 Bypass 2016-06-13 2016-07-14
5.0
None Remote Low Not required None Partial None
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
49 CVE-2016-5008 284 Bypass 2016-07-13 2016-07-14
4.3
None Remote Medium Not required None Partial None
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
50 CVE-2016-4979 284 Bypass 2016-07-06 2016-07-08
5.0
None Remote Low Not required None Partial None
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.
Total number of vulnerabilities : 4478   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.