CWE-284 · Improper Access Control (page 54)
Page 54 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18404 | Low | 3.1 | 2019-08-02 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). |
CVE-2017-18403 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10166 | High | 7.8 | 2019-08-02 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML()… |
CVE-2017-18385 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
CVE-2017-18384 | Low | 3.8 | 2019-08-02 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
CVE-2016-10820 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
CVE-2018-20938 | Low | 2.7 | 2019-08-01 | cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
CVE-2016-10830 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
CVE-2018-20930 | Medium | 6.5 | 2019-08-01 | cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). |
CVE-2016-10838 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
CVE-2016-10860 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
CVE-2016-10857 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
CVE-2016-10856 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
CVE-2016-10852 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
CVE-2015-9291 | High | 7.5 | 2019-08-01 | cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
CVE-2018-20890 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
CVE-2014-8183 | High | 7.4 | 2019-08-01 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access… |
CVE-2019-10189 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assig… |
CVE-2019-10188 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |
CVE-2019-10187 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-5452 | Low | 2.4 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although t… |
CVE-2019-10138 | High | 8.8 | 2019-07-30 | A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient ac… |
CVE-2019-10130 | Medium | 4.3 | 2019-07-30 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9… |
CVE-2017-18380 | High | 7.5 | 2019-07-30 | edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name. |
CVE-2019-9884 | Critical | 9.8 | 2019-07-25 | eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page. |
CVE-2018-13896 | High | 7.8 | 2019-07-22 | XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_SEC stage.. in Snap… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-10970 | Critical | 9.8 | 2019-07-11 | In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, una… |
CVE-2019-1010316 | High | 7.8 | 2019-07-11 | pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is… |
CVE-2019-9886 | High | 7.5 | 2019-07-11 | Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version… |
CVE-2018-19588 | High | 7.2 | 2019-07-11 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control. |
CVE-2018-17151 | Medium | 5.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. |
CVE-2018-11744 | High | 8.1 | 2019-07-11 | Cloudera Manager through 5.15 has Incorrect Access Control. |
CVE-2018-19576 | High | 8.1 | 2019-07-10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest… |
CVE-2018-19577 | Medium | 5.3 | 2019-07-10 | Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability t… |
CVE-2018-19496 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an in… |
CVE-2018-19494 | Medium | 4.3 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect a… |
CVE-2018-14833 | Medium | 5.9 | 2019-07-09 | Intuit Lacerte 2017 has Incorrect Access Control. |
CVE-2019-1890 | Medium | 6.5 | 2019-07-04 | A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch… |
CVE-2018-14859 | High | 8.1 | 2019-07-03 | Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to… |
CVE-2018-14864 | Medium | 6.5 | 2019-07-03 | Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authent… |
CVE-2018-14863 | High | 8.1 | 2019-07-03 | Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call privat… |
CVE-2019-13028 | High | 8.8 | 2019-06-28 | An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute a… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2018-14885 | Critical | 9.8 | 2019-06-28 | Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restor… |
CVE-2018-14867 | Medium | 5.3 | 2019-06-28 | Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post message… |
CVE-2019-1622 | Medium | 5.3 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve s… |
CVE-2019-1619 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass aut… |
CVE-2018-16553 | High | 7.2 | 2019-06-20 | In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin. |
CVE-2019-2729 | Critical | 9.8 | 2019-06-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6… |
CVE-2018-17148 | Critical | 9.8 | 2019-06-19 | An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before… |
CVE-2017-10721 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality e… |
CVE-2018-18958 | Medium | 6.5 | 2019-06-17 | OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. |
CVE-2019-10962 | Medium | 5.3 | 2019-06-13 | BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not… |
CVE-2019-10925 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially c… |
CVE-2018-10691 | High | 7.5 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same fun… |
CVE-2018-5264 | Medium | 5.9 | 2019-06-07 | Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/d… |
CVE-2019-3895 | High | 8.0 | 2019-06-03 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause… |
CVE-2019-3567 | High | 8.1 | 2019-06-03 | In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious bina… |
CVE-2018-5406 | High | 8.8 | 2019-06-03 | The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism… |
CVE-2019-11896 | High | 7.1 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that… |
CVE-2019-11895 | Medium | 5.3 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a… |
CVE-2019-11894 | Medium | 5.7 | 2019-05-29 | A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in una… |
CVE-2019-11892 | High | 8.0 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in r… |
CVE-2018-13895 | High | 7.8 | 2019-05-24 | Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdra… |
CVE-2017-11365 | Critical | 9.8 | 2019-05-23 | Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The ty… |
CVE-2017-5212 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. |
CVE-2017-8340 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-6912 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-5863 | Critical | 9.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2019-11634 | Critical | 9.8 | 2019-05-22 | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. |
CVE-2019-1649 | Medium | 6.7 | 2019-05-13 | A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an aut… |
CVE-2019-3566 | Medium | 5.9 | 2019-05-10 | A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover pre… |
CVE-2019-6566 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an atta… |
CVE-2019-6544 | Medium | 5.6 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrat… |
CVE-2019-5014 | Medium | 6.5 | 2019-05-08 | An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can… |
CVE-2019-1695 | Medium | 6.5 | 2019-05-03 | A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2019-3936 | High | 7.5 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389. The request wi… |
CVE-2019-3935 | Critical | 9.1 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to co… |
CVE-2019-3934 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to log… |
CVE-2019-3933 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide… |
CVE-2019-3928 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7… |
CVE-2019-3927 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.1… |
CVE-2019-10950 | Critical | 9.8 | 2019-04-30 | Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet service… |
CVE-2019-7476 | High | 8.1 | 2019-04-26 | A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability aff… |
CVE-2016-1587 | High | 7.1 | 2019-04-22 | The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the orig… |
CVE-2019-1805 | Medium | 4.3 | 2019-04-18 | A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could al… |
CVE-2019-1686 | High | 8.6 | 2019-04-17 | A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauth… |
CVE-2019-3845 | High | 8.0 | 2019-04-11 | A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Sate… |
CVE-2019-0041 | High | 8.6 | 2019-04-10 | On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail… |
CVE-2019-0036 | Critical | 9.8 | 2019-04-10 | When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignore… |
CVE-2019-8456 | Medium | 5.9 | 2019-04-09 | Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to succe… |
CVE-2019-6140 | Critical | 9.8 | 2019-04-09 | A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration pr… |
CVE-2018-15640 | High | 8.8 | 2019-04-09 | Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craf… |
CVE-2018-15631 | Medium | 6.5 | 2019-04-09 | Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-… |
CVE-2017-7912 | Critical | 9.8 | 2019-04-08 | Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gai… |