CVE-2016-10398

MEDIUM Year: 2016
CVSS v3 Score
6.2
Medium
CVSS v2 Score
7.2
High
Weakness Type
CWE-264
View all →

Vulnerability Description

Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens (AuthTokens) used by the Trusted Execution Environment (TEE) are protected by a weak challenge. This allows adversaries to replay previously captured responses and use the TEE without authenticating. All apps using authentication-gated cryptography are vulnerable to this attack, which was confirmed on the LG Nexus 5X.

Related Vulnerabilities

CVE-2023-7265

MEDIUM
CVSS:6.2(Medium)

Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability

CWE-2642023

CVE-2016-0763

MEDIUM
CVSS:6.3(Medium)

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkF...

CWE-2642016

CVE-2016-3302

MEDIUM
CVSS:6.3(Medium)

Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not properly restrict the loading of web content, which allows p...

CWE-2642016

CVE-2020-3485

MEDIUM
CVSS:6.3(Medium)

A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access re...

CWE-2642020

CVE-2020-7257

MEDIUM
CVSS:6.3(Medium)

Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not norm...

CWE-2642020

CVE-2025-5321

MEDIUM
CVSS:6.3(Medium)

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view...

CWE-2642025