CWE-284 · Improper Access Control (page 52)
Page 52 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1284 | High | 8.8 | 2021-05-06 | A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authe… |
CVE-2021-1477 | Medium | 4.3 | 2021-04-29 | A vulnerability in an access control mechanism of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access serv… |
CVE-2020-7038 | High | 7.5 | 2021-04-28 | A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain a… |
CVE-2021-22682 | High | 7.8 | 2021-04-23 | Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including read/write access. Thi… |
CVE-2021-26909 | Low | 3.7 | 2021-04-23 | Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker t… |
CVE-2021-24238 | Medium | 6.5 | 2021-04-22 | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the req… |
CVE-2021-0232 | High | 7.4 | 2021-04-22 | An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about th… |
CVE-2020-9668 | High | 7.8 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attack… |
CVE-2021-27258 | Critical | 9.8 | 2021-04-14 | This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not… |
CVE-2021-21399 | Critical | 9.1 | 2021-04-13 | Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic A… |
CVE-2021-27598 | Medium | 5.3 | 2021-04-13 | SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version… |
CVE-2021-24219 | Medium | 5.3 | 2021-04-12 | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7… |
CVE-2021-24215 | Critical | 9.8 | 2021-04-12 | An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website custom… |
CVE-2021-24198 | High | 8.1 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the… |
CVE-2021-24197 | High | 8.1 | 2021-04-12 | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the… |
CVE-2021-25359 | Medium | 4.0 | 2021-04-09 | An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted application… |
CVE-2021-21431 | High | 7.6 | 2021-04-09 | sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick… |
CVE-2021-1467 | Medium | 4.3 | 2021-04-08 | A vulnerability in Cisco Webex Meetings for Android could allow an authenticated, remote attacker to modify the avatar of another user. This vulnerability is d… |
CVE-2021-21425 | Critical | 9.3 | 2021-04-07 | Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticat… |
CVE-2021-27653 | Medium | 6.6 | 2021-04-01 | Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure. |
CVE-2021-25349 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the Pend… |
CVE-2021-1449 | Medium | 6.7 | 2021-03-24 | A vulnerability in the boot logic of Cisco Access Points Software could allow an authenticated, local attacker to execute unsigned code at boot time. The vulne… |
CVE-2019-10200 | High | 7.2 | 2021-03-19 | A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on mast… |
CVE-2019-10128 | High | 7.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of t… |
CVE-2019-10127 | High | 8.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the bin… |
CVE-2021-24146 | High | 7.5 | 2021-03-18 | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files… |
CVE-2021-25672 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1). The Forgot Password Marketplace module does not properly… |
CVE-2020-29020 | Critical | 9.1 | 2021-03-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured… |
CVE-2021-25340 | Medium | 5.1 | 2021-03-04 | Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary… |
CVE-2021-22877 | Medium | 6.5 | 2021-03-03 | A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not alre… |
CVE-2021-1231 | Medium | 4.7 | 2021-02-24 | A vulnerability in the Link Layer Discovery Protocol (LLDP) for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow… |
CVE-2021-1228 | High | 7.4 | 2021-02-24 | A vulnerability in the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (AC… |
CVE-2020-8902 | Low | 3.5 | 2021-02-23 | Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force… |
CVE-2021-26559 | Medium | 6.5 | 2021-02-17 | Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations inc… |
CVE-2021-22853 | Medium | 5.4 | 2021-02-17 | The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data pack… |
CVE-2021-21045 | High | 8.2 | 2021-02-11 | Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper acc… |
CVE-2021-21020 | Medium | 5.3 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as C… |
CVE-2020-25238 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in s… |
CVE-2020-14312 | Medium | 5.9 | 2021-02-06 | A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it li… |
CVE-2021-1389 | Medium | 5.8 | 2021-02-04 | A vulnerability in the IPv6 traffic processing of Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices could allow an unauthenticated, remo… |
CVE-2021-1243 | Medium | 5.3 | 2021-02-04 | A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software cou… |
CVE-2020-27873 | Medium | 6.5 | 2021-02-04 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authe… |
CVE-2020-2506 | High | 7.3 | 2021-02-03 | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compr… |
CVE-2019-20473 | Medium | 6.8 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is co… |
CVE-2019-20470 | High | 7.5 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up… |
CVE-2021-26118 | High | 7.5 | 2021-01-27 | While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed p… |
CVE-2021-0205 | Medium | 5.8 | 2021-01-15 | When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destinatio… |
CVE-2020-8275 | Medium | 4.3 | 2021-01-06 | Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2019-11786 | Medium | 4.3 | 2020-12-22 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms… |
CVE-2019-11785 | Medium | 4.3 | 2020-12-22 | Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users t… |
CVE-2019-11784 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated use… |
CVE-2019-11783 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated… |
CVE-2019-11782 | Medium | 6.5 | 2020-12-22 | Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact manag… |
CVE-2018-15645 | Medium | 6.5 | 2020-12-22 | Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create… |
CVE-2020-35497 | Medium | 6.5 | 2020-12-21 | A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public S… |
CVE-2020-10143 | High | 7.8 | 2020-12-09 | Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses thi… |
CVE-2020-25629 | High | 8.8 | 2020-12-08 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site admin… |
CVE-2020-7547 | High | 8.8 | 2020-12-01 | A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for v… |
CVE-2020-7545 | High | 7.2 | 2020-12-01 | A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for ve… |
CVE-2020-25654 | High | 7.2 | 2020-11-24 | An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various… |
CVE-2020-7573 | Medium | 6.5 | 2020-11-19 | A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able t… |
CVE-2020-7561 | Critical | 9.8 | 2020-11-19 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of pro… |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25698 | High | 7.5 | 2020-11-19 | Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrollin… |
CVE-2020-8278 | Medium | 5.3 | 2020-11-19 | Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. |
CVE-2020-3482 | Medium | 6.5 | 2020-11-18 | A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker t… |
CVE-2020-26080 | Medium | 4.1 | 2020-11-18 | A vulnerability in the user management functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to manage user inf… |
CVE-2020-26077 | Medium | 4.3 | 2020-11-18 | A vulnerability in the access control functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to view lists of us… |
CVE-2020-26072 | High | 8.7 | 2020-11-18 | A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on dev… |
CVE-2020-26224 | High | 7.5 | 2020-11-16 | In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows… |
CVE-2020-24441 | Medium | 5.5 | 2020-11-12 | Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in… |
CVE-2020-3592 | Medium | 6.5 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization an… |
CVE-2020-3284 | Critical | 9.8 | 2020-11-06 | A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacke… |
CVE-2020-25662 | Medium | 5.3 | 2020-11-05 | A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memor… |
CVE-2020-24433 | High | 7.8 | 2020-11-05 | Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege… |
CVE-2020-16261 | Medium | 6.8 | 2020-10-28 | Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access. |
CVE-2020-3565 | Medium | 5.8 | 2020-10-21 | A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass c… |
CVE-2020-3564 | Medium | 5.3 | 2020-10-21 | A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-10139 | High | 7.8 | 2020-10-21 | Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image cont… |
CVE-2020-10138 | High | 7.8 | 2020-10-21 | Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. A… |
CVE-2020-1666 | Medium | 6.6 | 2020-10-16 | The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console ca… |
CVE-2020-8182 | High | 8.0 | 2020-10-05 | Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. |
CVE-2020-3524 | Medium | 6.8 | 2020-09-24 | A vulnerability in the Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services… |
CVE-2020-3503 | Medium | 6.0 | 2020-09-24 | A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critica… |
CVE-2020-3418 | Medium | 4.7 | 2020-09-24 | A vulnerability in Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9800 Series Routers could allow an unauthenticated, adjacent attacker to send I… |
CVE-2020-3396 | Medium | 6.8 | 2020-09-24 | A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker t… |
CVE-2020-15181 | Critical | 9.3 | 2020-09-18 | The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using… |
CVE-2020-8028 | Critical | 9.3 | 2020-09-17 | A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE… |
CVE-2020-7531 | High | 7.8 | 2020-09-16 | A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place executables in a… |
CVE-2020-3522 | Medium | 6.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to byp… |
CVE-2020-16241 | Medium | 6.3 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2020-3448 | Medium | 5.8 | 2020-08-17 | A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication a… |
CVE-2020-3413 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to delete a scheduled meeting t… |
CVE-2020-3412 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to create a scheduled meeting t… |
CVE-2020-5396 | High | 8.8 | 2020-07-31 | VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a… |
CVE-2020-10731 | Critical | 9.9 | 2020-07-31 | A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, a… |
CVE-2020-10930 | Medium | 6.5 | 2020-07-28 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Au… |
CVE-2020-8207 | High | 8.8 | 2020-07-24 | Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater servi… |