CWE-284 · Improper Access Control (page 53)
Page 53 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15102 | Medium | 6.5 | 2020-07-21 | In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is… |
CVE-2020-3144 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router… |
CVE-2020-10288 | Critical | 9.8 | 2020-07-15 | IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever… |
CVE-2020-14499 | High | 7.5 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to o… |
CVE-2020-7578 | High | 8.1 | 2020-07-14 | A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Authenticated users could hav… |
CVE-2020-8196 | Medium | 4.3 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8193 | Medium | 6.5 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8179 | Medium | 4.1 | 2020-07-02 | Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. |
CVE-2020-15079 | Medium | 6.4 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The probl… |
CVE-2020-2500 | Critical | 9.8 | 2020-07-01 | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP… |
CVE-2020-12024 | Medium | 6.1 | 2020-06-29 | Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from… |
CVE-2020-10278 | Medium | 4.6 | 2020-06-24 | The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged… |
CVE-2020-4062 | High | 8.7 | 2020-06-22 | In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open p… |
CVE-2020-3364 | Medium | 5.3 | 2020-06-18 | A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unau… |
CVE-2020-3245 | Medium | 5.3 | 2020-06-18 | A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrar… |
CVE-2020-3231 | Medium | 4.7 | 2020-06-03 | A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent atta… |
CVE-2020-12493 | Critical | 10.0 | 2020-05-29 | An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via netw… |
CVE-2020-6774 | Critical | 9.3 | 2020-05-27 | Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and ac… |
CVE-2020-9046 | High | 8.8 | 2020-05-26 | A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by… |
CVE-2020-2025 | High | 8.8 | 2020-05-19 | Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite t… |
CVE-2020-11931 | Low | 3.3 | 2020-05-15 | An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restri… |
CVE-2020-10612 | Critical | 9.1 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any re… |
CVE-2020-8153 | High | 8.1 | 2020-05-12 | Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name. |
CVE-2020-3329 | Medium | 4.3 | 2020-05-06 | A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for… |
CVE-2020-3312 | High | 7.5 | 2020-05-06 | A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gai… |
CVE-2020-3253 | Medium | 6.7 | 2020-05-06 | A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell… |
CVE-2020-3186 | Medium | 5.3 | 2020-05-06 | A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2020-1732 | Medium | 4.2 | 2020-05-04 | A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads… |
CVE-2020-8157 | Medium | 6.8 | 2020-05-02 | UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unrestricted root access through the serial… |
CVE-2020-11028 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of condition… |
CVE-2020-10641 | High | 7.5 | 2020-04-28 | An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in co… |
CVE-2020-5293 | Medium | 6.5 | 2020-04-20 | In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The… |
CVE-2020-5288 | Medium | 4.1 | 2020-04-20 | "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. |
CVE-2020-5287 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. |
CVE-2020-5279 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.p… |
CVE-2020-7278 | High | 7.4 | 2020-04-15 | Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Ap… |
CVE-2020-3126 | Low | 3.0 | 2020-04-13 | vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vu… |
CVE-2019-1866 | Low | 3.1 | 2020-04-13 | Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicati… |
CVE-2020-5302 | High | 8.2 | 2020-04-07 | MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface… |
CVE-2019-3942 | High | 7.5 | 2020-04-01 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerabilit… |
CVE-2020-8139 | Medium | 6.5 | 2020-03-20 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to… |
CVE-2020-7253 | Medium | 5.7 | 2020-03-12 | Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protect… |
CVE-2020-6971 | High | 7.8 | 2020-03-05 | In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges… |
CVE-2019-5162 | High | 8.8 | 2020-02-25 | An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specia… |
CVE-2019-5136 | High | 8.8 | 2020-02-25 | An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu… |
CVE-2020-5244 | High | 8.0 | 2020-02-24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has bee… |
CVE-2020-5242 | High | 7.7 | 2020-02-20 | openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the… |
CVE-2019-18998 | High | 7.1 | 2020-02-17 | Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full acce… |
CVE-2019-6193 | High | 7.5 | 2020-02-14 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to… |
CVE-2019-6744 | Medium | 4.3 | 2020-02-10 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G960… |
CVE-2020-8122 | Medium | 4.3 | 2020-02-04 | A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. |
CVE-2020-8121 | High | 8.1 | 2020-02-04 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. |
CVE-2019-15615 | Medium | 6.1 | 2020-02-04 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2019-15590 | High | 7.5 | 2020-01-28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests… |
CVE-2020-3142 | High | 7.5 | 2020-01-26 | A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-pr… |
CVE-2019-15255 | Medium | 6.5 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authoriza… |
CVE-2019-14902 | Medium | 5.4 | 2020-01-21 | There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the re… |
CVE-2019-18275 | Medium | 6.5 | 2020-01-15 | OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access control, which may return unauthorized tag… |
CVE-2020-1604 | Medium | 6.5 | 2020-01-15 | On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets… |
CVE-2019-15999 | Medium | 6.3 | 2020-01-06 | A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized a… |
CVE-2019-11780 | High | 8.1 | 2019-12-19 | Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to… |
CVE-2019-5487 | Medium | 5.3 | 2019-12-18 | An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return… |
CVE-2019-15591 | Medium | 6.5 | 2019-12-18 | An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge… |
CVE-2019-15589 | High | 8.8 | 2019-12-18 | An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pul… |
CVE-2019-18309 | High | 7.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with local access to the MS3000 Server and a low privileg… |
CVE-2019-18308 | High | 7.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with local access to the MS3000 Server and a low privileg… |
CVE-2019-15998 | Medium | 5.3 | 2019-11-26 | A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control lis… |
CVE-2019-15967 | Medium | 4.4 | 2019-11-26 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable a… |
CVE-2019-15956 | High | 8.8 | 2019-11-26 | A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker… |
CVE-2019-5644 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5643 | Medium | 5.3 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5617 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-6144 | Medium | 6.5 | 2019-10-23 | This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection. |
CVE-2019-15260 | Critical | 9.8 | 2019-10-16 | A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device… |
CVE-2019-14838 | Medium | 4.9 | 2019-10-14 | A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime sta… |
CVE-2019-9531 | Critical | 9.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated… |
CVE-2019-9530 | Medium | 5.5 | 2019-10-10 | The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an… |
CVE-2019-9529 | Medium | 5.5 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local atta… |
CVE-2019-3653 | Medium | 4.6 | 2019-10-09 | Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain acc… |
CVE-2019-12670 | Medium | 6.7 | 2019-09-25 | A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace cont… |
CVE-2019-12648 | High | 8.8 | 2019-09-25 | A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Gues… |
CVE-2019-15068 | Critical | 9.8 | 2019-09-25 | A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset admi… |
CVE-2019-6810 | High | 8.8 | 2019-09-17 | CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of c… |
CVE-2019-13919 | Medium | 4.3 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user c… |
CVE-2019-11899 | High | 7.5 | 2019-09-12 | An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Pr… |
CVE-2019-13656 | Critical | 9.8 | 2019-09-06 | An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to… |
CVE-2018-15513 | Medium | 5.3 | 2019-08-30 | Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role. |
CVE-2018-21007 | Critical | 9.8 | 2019-08-29 | The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. |
CVE-2015-9337 | High | 7.5 | 2019-08-22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. |
CVE-2019-12627 | High | 7.5 | 2019-08-21 | A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2019-5036 | High | 7.5 | 2019-08-20 | An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafte… |
CVE-2017-18543 | Critical | 9.8 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. |
CVE-2018-20957 | High | 8.8 | 2019-08-08 | The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks. |
CVE-2016-10802 | High | 8.8 | 2019-08-07 | cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). |
CVE-2016-10799 | Medium | 5.5 | 2019-08-07 | cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). |
CVE-2016-10792 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141). |
CVE-2017-18457 | Medium | 4.4 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). |
CVE-2017-18421 | Low | 3.3 | 2019-08-02 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). |
CVE-2019-10938 | Critical | 9.8 | 2019-08-02 | A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100… |