CVE Vulnerability Catalog

CVE-2016-6728 is a vulnerability in the Android kernel ION subsystem before 2016-11-05 that allows a local malicious application to gain elevated privileges and execute arbitrary code within the kernel context. This issue is rated as Critical due to the potential for permanent device compromise.

CVE-2016-6725 describes a remote code execution vulnerability in the Qualcomm crypto driver in Android before November 5, 2016. An attacker could execute arbitrary code within the context of the kernel.

CVE-2016-6717 is a vulnerability in Mediaserver on Android versions before 4.4.4, 5.0.2, 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01, allowing a local malicious application to gain elevated privileges and execute arbitrary code within a privileged process context. However, it requires prior exploitation of another vulnerability.

CVE-2016-6707 is a vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 that allows a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High due to the potential for gaining local access to elevated capabilities not normally accessible to third-party applications.

A vulnerability in Mediaserver in Android allows a local malicious application to execute arbitrary code within the context of a privileged process. This affects Android versions 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01.

There is an elevation of privilege vulnerability in Mediaserver in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01. A local malicious application could execute arbitrary code within the context of a privileged process.

A remote code execution vulnerability exists in an Android runtime library in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before November 1, 2016. An attacker can exploit this issue using a specially crafted payload to execute arbitrary code in the context of an unprivileged process.

A remote code execution vulnerability in libjpeg in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process.

A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing.

An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a local malicious application to execute arbitrary code within the context of a privileged process.

CVE-2016-3904 is a vulnerability in the Qualcomm bus driver in Android before 2016-11-05 that allows a local malicious application to gain elevated privileges and execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.

General Electric (GE) Bently Nevada 3500/22M USB devices with firmware before version 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.

IBM Security Access Manager for Web versions 7.0 before IF2, 8.0 before 8.0.1.4 IF3, and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.

IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, making it easier for remote attackers to gain access via a brute-force approach.

IBM Tivoli Storage Manager for Virtual Environments before version 6.4.3.4 and 7.1.6 has a vulnerability that allows remote authenticated users to bypass TSM credential requirements and gain administrative access by leveraging multiple simultaneous logins.

IBM Spectrum Scale and General Parallel File System (GPFS) have a vulnerability that allows local users to gain elevated privileges via crafted environment variables in a setuid program.

IBM Spectrum Scale and General Parallel File System (GPFS) have a vulnerability that allows local users to gain elevated privileges via crafted command-line parameters to a setuid program.

Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

A vulnerability has been identified in SIMATIC CP 343-1 Advanced, CP 443-1 Advanced, and the S7-300 and S7-400 PN/DP CPU families. The integrated web server at port 80/TCP or 443/TCP may allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request.