TYPE DE FAIBLESSE

CWE-16

31 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-16 (en anglais) →

CVE-2026-56586HCL IEM n'envoie pas un en-tête de sécurité spécifique qui empêche les navigateurs de deviner le type de contenu d'un fichier. Un attaquant sur le même réseau pourrait utiliser cel… 3.1 FAIBLE

CVE-2026-14971Les installations IBM PowerVM NovaLink sont affectées par une erreur de configuration dans leurs API. Un attaquant disposant de privilèges administratifs de haut niveau et d'un acc… 3.9 FAIBLE

CVE-2026-4433Les installations Tenable OT présentant des configurations SSH incorrectes sont susceptibles de subir des fuites d'informations. Un utilisateur authentifié disposant d'un accès rés… 1.9 FAIBLE

CVE-2025-12221Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. 2.1 FAIBLE

CVE-2019-19092ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. 3.5 FAIBLE

CVE-2019-19090For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible… 3.5 FAIBLE

CVE-2020-1769In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Com… 3.5 FAIBLE

CVE-2014-4440The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles, which allows remote attackers t… 2.6 FAIBLE

CVE-2014-3052The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the in… 3.3 FAIBLE

CVE-2012-5512Array index error in the HVMOP_set_mem_access handler in Xen 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) or obtain sensitive information via u… 3.2 FAIBLE

CVE-2012-3276HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs… 2.1 FAIBLE

CVE-2012-4537Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS admi… 2.1 FAIBLE

CVE-2000-1247The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwor… 2.1 FAIBLE

CVE-2011-1424The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly… 3.5 FAIBLE

CVE-2011-1499acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attacke… 2.6 FAIBLE

CVE-2011-1681vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resourc… 3.3 FAIBLE

CVE-2011-1089The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it… 3.3 FAIBLE

CVE-2010-4021The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authent… 2.1 FAIBLE

CVE-2010-1381The default configuration of SMB File Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, enables support for wide links, which allows remote authenticated users to access arb… 3.5 FAIBLE

CVE-2009-3746XScreenSaver in Sun Solaris 10, when the accessibility feature is enabled, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are… 1.9 FAIBLE

CVE-2009-2089The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allow… 2.1 FAIBLE

CVE-2009-1295Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report… 1.9 FAIBLE

CVE-2009-0489The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon… 2.1 FAIBLE

CVE-2007-6505Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, w… 3.5 FAIBLE

CVE-2007-6210zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges. 2.1 FAIBLE

CVE-2007-6131buttonpressed.sh in scanbuttond 0.2.3 allows local users to overwrite arbitrary files via a symlink attack on the (1) scan.pnm and (2) scan.jpg temporary files. 2.1 FAIBLE

CVE-2007-5420The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled but a web server has been configured, serves a web page to external clients, which might all… 2.6 FAIBLE

CVE-2007-5375Interpretation conflict in the Sun Java Virtual Machine (JVM) allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in … 2.6 FAIBLE

CVE-2003-1452Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH environment variable to reference a mali… 3.6 FAIBLE

CVE-2003-1426Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execut… 3.3 FAIBLE

CVE-2002-2280syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which ca… 2.1 FAIBLE