Total
5210 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-2416 | 1 Google | 1 Android | 2016-04-25 | 10.0 HIGH | 9.8 CRITICAL |
| libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057. | |||||
| CVE-2016-2422 | 1 Google | 1 Android | 2016-04-25 | 9.3 HIGH | 7.8 HIGH |
| Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324357. | |||||
| CVE-2016-2419 | 1 Google | 1 Android | 2016-04-25 | 10.0 HIGH | 9.8 CRITICAL |
| media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455. | |||||
| CVE-2016-2420 | 1 Google | 1 Android | 2016-04-22 | 9.3 HIGH | 7.8 HIGH |
| rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620. | |||||
| CVE-2016-2412 | 1 Google | 1 Android | 2016-04-22 | 9.3 HIGH | 7.8 HIGH |
| include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, mishandles certain crashes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26593930. | |||||
| CVE-2016-2413 | 1 Google | 1 Android | 2016-04-21 | 9.3 HIGH | 7.8 HIGH |
| media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627. | |||||
| CVE-2016-2409 | 1 Google | 1 Android | 2016-04-21 | 9.3 HIGH | 8.1 HIGH |
| A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 25981545. | |||||
| CVE-2016-0850 | 1 Google | 1 Android | 2016-04-21 | 5.8 MEDIUM | 8.8 HIGH |
| The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752. | |||||
| CVE-2016-0847 | 1 Google | 1 Android | 2016-04-21 | 7.2 HIGH | 8.4 HIGH |
| The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502. | |||||
| CVE-2016-2410 | 1 Google | 1 Android | 2016-04-20 | 6.9 MEDIUM | 7.4 HIGH |
| A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677. | |||||
| CVE-2016-0844 | 1 Google | 1 Android | 2016-04-20 | 7.2 HIGH | 8.4 HIGH |
| The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via a crafted application, aka internal bug 26324307. | |||||
| CVE-2016-0843 | 1 Google | 1 Android | 2016-04-20 | 7.2 HIGH | 8.4 HIGH |
| The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197. | |||||
| CVE-2014-6276 | 2 Debian, Roundup-tracker | 2 Debian Linux, Roundup | 2016-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
| schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details. | |||||
| CVE-2016-0735 | 1 Apache | 1 Ranger | 2016-04-19 | 6.5 MEDIUM | 8.8 HIGH |
| Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy. | |||||
| CVE-2016-1235 | 2 Debian, Oar Project | 2 Debian Linux, Oar | 2016-04-14 | 9.0 HIGH | 8.8 HIGH |
| The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options. | |||||
| CVE-2016-2171 | 1 Apache | 1 Jetspeed | 2016-04-14 | 6.4 MEDIUM | 7.5 HIGH |
| The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API. | |||||
| CVE-2016-3187 | 1 Prepopulate Project | 1 Prepopulate | 2016-04-14 | 7.5 HIGH | 7.3 HIGH |
| The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter. | |||||
| CVE-2016-3188 | 1 Prepopulate Project | 1 Prepopulate | 2016-04-14 | 7.5 HIGH | 7.3 HIGH |
| The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have unspecified impact, via unspecified vectors. | |||||
| CVE-2016-2405 | 1 Huawei | 2 Policy Center, Policy Center Firmware | 2016-04-14 | 9.0 HIGH | 8.8 HIGH |
| Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL. | |||||
| CVE-2016-2393 | 1 Lenovo | 2 Fingerprint Manager, Touch Fingerprint | 2016-04-14 | 7.2 HIGH | 7.8 HIGH |
| Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local users to gain privileges by invalidating local checks. | |||||