CWE-284 · Improper Access Control (page 51)
Page 51 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22565 | Medium | 6.5 | 2021-12-09 | An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposur… |
CVE-2021-42124 | High | 8.8 | 2021-12-07 | An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session ta… |
CVE-2021-35245 | High | 8.4 | 2021-12-06 | When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. |
CVE-2021-26334 | Critical | 9.9 | 2021-12-01 | The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 c… |
CVE-2020-10627 | High | 7.3 | 2021-12-01 | Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured P… |
CVE-2021-3992 | Medium | 6.5 | 2021-12-01 | kimai2 is vulnerable to Improper Access Control |
CVE-2021-4026 | Medium | 4.3 | 2021-11-30 | bookstack is vulnerable to Improper Access Control |
CVE-2021-42116 | Medium | 4.3 | 2021-11-30 | Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote atta… |
CVE-2021-36917 | Medium | 6.5 | 2021-11-24 | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used… |
CVE-2021-3554 | Critical | 9.0 | 2021-11-24 | Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attack… |
CVE-2021-40130 | Medium | 4.9 | 2021-11-19 | A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log file… |
CVE-2021-36909 | High | 8.8 | 2021-11-18 | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire databas… |
CVE-2021-42360 | High | 7.6 | 2021-11-17 | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level… |
CVE-2021-35528 | High | 7.2 | 2021-11-17 | Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Bill… |
CVE-2021-24853 | Medium | 4.3 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action… |
CVE-2021-26338 | High | 7.5 | 2021-11-16 | Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potent… |
CVE-2021-3062 | High | 8.1 | 2021-11-10 | An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to t… |
CVE-2020-12488 | Medium | 5.5 | 2021-11-10 | The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permi… |
CVE-2021-24816 | Medium | 4.3 | 2021-11-08 | The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Au… |
CVE-2021-24801 | Medium | 4.3 | 2021-11-08 | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them an… |
CVE-2021-24698 | Medium | 4.3 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, e… |
CVE-2021-42359 | High | 7.5 | 2021-11-05 | WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthe… |
CVE-2021-25501 | Medium | 5.7 | 2021-11-05 | An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some… |
CVE-2021-40113 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-40112 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-34795 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-39333 | High | 8.1 | 2021-11-01 | The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users fo… |
CVE-2021-24781 | Medium | 4.3 | 2021-11-01 | The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (… |
CVE-2021-41194 | Critical | 9.1 | 2021-10-28 | FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with Fi… |
CVE-2021-34794 | Medium | 5.3 | 2021-10-27 | A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software a… |
CVE-2021-34754 | Medium | 5.8 | 2021-10-27 | Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2021-34864 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-21703 | High | 7.8 | 2021-10-25 | In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as… |
CVE-2021-38457 | Critical | 9.8 | 2021-10-22 | The server permits communication without any authentication procedure, allowing the attacker to initiate a session with the server without providing any form o… |
CVE-2021-24752 | Medium | 5.7 | 2021-10-18 | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users… |
CVE-2021-38454 | Critical | 10.0 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-28129 | High | 7.8 | 2021-10-07 | While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500… |
CVE-2021-38392 | Medium | 6.5 | 2021-10-04 | A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could us… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-41298 | High | 8.8 | 2021-09-30 | ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied… |
CVE-2020-12030 | Critical | 10.0 | 2021-09-29 | There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the… |
CVE-2021-20034 | Critical | 9.1 | 2021-09-27 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file po… |
CVE-2021-22941 | Critical | 9.8 | 2021-09-23 | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zo… |
CVE-2021-34724 | Medium | 6.0 | 2021-09-23 | A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the un… |
CVE-2021-34696 | Medium | 5.8 | 2021-09-23 | A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, r… |
CVE-2021-1625 | Medium | 5.8 | 2021-09-23 | A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent the Zone-Based Po… |
CVE-2021-1419 | High | 7.8 | 2021-09-23 | A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the af… |
CVE-2021-24635 | Medium | 5.4 | 2021-09-20 | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authentic… |
CVE-2021-24583 | Medium | 4.3 | 2021-09-20 | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_po… |
CVE-2021-37183 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications… |
CVE-2021-25463 | Medium | 4.0 | 2021-09-09 | Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. |
CVE-2021-35213 | High | 8.9 | 2021-08-31 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to… |
CVE-2021-35221 | Medium | 6.3 | 2021-08-31 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-1591 | Medium | 5.8 | 2021-08-25 | A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass acces… |
CVE-2021-1583 | Medium | 4.4 | 2021-08-25 | A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI)… |
CVE-2021-1581 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1580 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1577 | Critical | 9.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-25956 | Medium | 4.7 | 2021-08-17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate alrea… |
CVE-2021-1113 | Medium | 4.7 | 2021-08-11 | NVIDIA camera firmware contains a difficult to exploit vulnerability where a highly privileged attacker can cause unauthorized modification to camera resources… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2021-24500 | High | 8.1 | 2021-08-09 | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that… |
CVE-2021-32002 | Medium | 4.3 | 2021-08-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configu… |
CVE-2021-22920 | Medium | 6.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-25448 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. |
CVE-2021-25447 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview. |
CVE-2021-25446 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview. |
CVE-2021-1601 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-1600 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-25320 | Critical | 9.9 | 2021-07-15 | A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credenti… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-25440 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated priv… |
CVE-2021-25439 | Low | 3.3 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25438 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25431 | Medium | 5.5 | 2021-07-08 | Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows untrusted application… |
CVE-2021-28809 | Critical | 9.8 | 2021-07-08 | An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to com… |
CVE-2021-32517 | High | 7.5 | 2021-07-07 | Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in d… |
CVE-2021-32514 | High | 7.5 | 2021-07-07 | Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the device. The referred vul… |
CVE-2021-34627 | Medium | 4.3 | 2021-07-07 | A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom ex… |
CVE-2021-34626 | Medium | 4.3 | 2021-07-07 | A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions… |
CVE-2021-28579 | Medium | 4.3 | 2021-06-28 | Adobe Connect version 11.2.1 (and earlier) is affected by an Improper access control vulnerability that can lead to the elevation of privileges. An attacker wi… |
CVE-2021-21083 | High | 7.5 | 2021-06-28 | AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control v… |
CVE-2021-23845 | High | 8.0 | 2021-06-18 | This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a sec… |
CVE-2020-8300 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access contr… |
CVE-2021-24359 | Medium | 5.3 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate use… |
CVE-2021-25412 | High | 7.8 | 2021-06-11 | An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system… |
CVE-2021-25405 | Medium | 5.5 | 2021-06-11 | An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files. |
CVE-2020-14388 | Medium | 6.3 | 2021-06-02 | A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows… |
CVE-2021-32656 | High | 8.6 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2… |
CVE-2021-32652 | High | 8.8 | 2021-06-01 | Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users… |
CVE-2021-24318 | Medium | 6.5 | 2021-06-01 | The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authentica… |
CVE-2020-10145 | High | 7.8 | 2021-05-27 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, u… |
CVE-2021-22907 | High | 7.8 | 2021-05-27 | An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 19… |
CVE-2020-27831 | Medium | 4.3 | 2021-05-27 | A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notification… |
CVE-2020-25634 | Medium | 5.4 | 2021-05-26 | A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or mo… |
CVE-2021-28798 | High | 8.8 | 2021-05-21 | A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to mo… |
CVE-2020-15279 | Medium | 4.0 | 2021-05-18 | An Improper Access Control vulnerability in the logging component of Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.23.320 allows a regu… |
CVE-2020-36197 | High | 7.1 | 2021-05-13 | An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to co… |
CVE-2021-1515 | Medium | 4.3 | 2021-05-06 | A vulnerability in Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to gain access to sensitive information. This vulnerability… |
CVE-2021-1478 | Medium | 5.3 | 2021-05-06 | A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager… |