CWE-284 · Improper Access Control (page 55)
Page 55 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6554 | High | 7.5 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. |
CVE-2019-7475 | Critical | 9.8 | 2019-04-02 | A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing s… |
CVE-2019-1759 | Medium | 5.3 | 2019-03-28 | A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated… |
CVE-2017-9626 | Critical | 9.8 | 2019-03-27 | Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This up… |
CVE-2018-12546 | Medium | 6.5 | 2019-03-27 | In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the ret… |
CVE-2010-5305 | Critical | 9.8 | 2019-03-26 | The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controll… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2018-16838 | Medium | 5.4 | 2019-03-25 | A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side… |
CVE-2019-1763 | High | 7.5 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-1690 | Medium | 6.5 | 2019-03-11 | A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent atta… |
CVE-2019-1601 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-6520 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. |
CVE-2019-1666 | Medium | 5.3 | 2019-02-21 | A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service… |
CVE-2019-1664 | High | 7.8 | 2019-02-21 | A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluste… |
CVE-2013-5654 | Critical | 9.1 | 2019-02-15 | Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage |
CVE-2019-1660 | Medium | 5.3 | 2019-02-07 | A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attack… |
CVE-2019-6517 | Medium | 6.8 | 2019-02-06 | BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric… |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2019-1653 | High | 7.5 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remo… |
CVE-2019-1647 | High | 8.0 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to ot… |
CVE-2018-15459 | Medium | 6.5 | 2019-01-23 | A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional pr… |
CVE-2018-19634 | High | 7.5 | 2019-01-22 | CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information. |
CVE-2018-15466 | Medium | 5.3 | 2019-01-11 | A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remo… |
CVE-2018-0484 | Medium | 5.3 | 2019-01-10 | A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual rout… |
CVE-2018-13816 | Critical | 10.0 | 2018-12-12 | A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. S… |
CVE-2018-7364 | Critical | 9.8 | 2018-12-07 | All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access c… |
CVE-2018-16476 | High | 7.5 | 2018-11-30 | A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using… |
CVE-2018-17953 | High | 7.5 | 2018-11-27 | A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_ac… |
CVE-2018-7362 | High | 7.5 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perfor… |
CVE-2018-15394 | Critical | 9.8 | 2018-11-08 | A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authent… |
CVE-2018-17931 | Medium | 6.8 | 2018-10-30 | If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be able to alter scrip… |
CVE-2018-16466 | High | 8.1 | 2018-10-30 | Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens. |
CVE-2018-17908 | High | 7.8 | 2018-10-29 | WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installatio… |
CVE-2018-17921 | High | 8.8 | 2018-10-24 | SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without human interaction. |
CVE-2018-15395 | Medium | 5.4 | 2018-10-17 | A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjac… |
CVE-2018-15398 | Medium | 4.0 | 2018-10-05 | A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2018-15372 | High | 8.1 | 2018-10-05 | A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Sof… |
CVE-2018-15371 | Medium | 6.7 | 2018-10-05 | A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain u… |
CVE-2018-0447 | Medium | 5.3 | 2018-10-05 | A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, r… |
CVE-2018-0436 | High | 8.7 | 2018-10-05 | A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other tha… |
CVE-2018-14804 | Critical | 9.8 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution. |
CVE-2018-15611 | Medium | 6.3 | 2018-09-27 | A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local syste… |
CVE-2018-10500 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must… |
CVE-2018-15610 | High | 7.3 | 2018-09-12 | A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected ve… |
CVE-2018-7791 | Critical | 9.8 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2016-7048 | High | 8.1 | 2018-08-20 | The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by le… |
CVE-2018-0428 | Medium | 6.7 | 2018-08-15 | A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to… |
CVE-2018-10630 | Critical | 9.8 | 2018-08-10 | For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there i… |
CVE-2018-11456 | Medium | 5.8 | 2018-08-07 | A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device could send speciall… |
CVE-2017-7497 | Medium | 4.1 | 2018-07-27 | The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage vol… |
CVE-2017-12171 | Medium | 6.5 | 2018-07-26 | A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be par… |
CVE-2017-2664 | Medium | 6.5 | 2018-07-26 | CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms… |
CVE-2018-10905 | High | 7.8 | 2018-07-24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile… |
CVE-2018-0343 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary cod… |
CVE-2016-6543 | Medium | 5.9 | 2018-07-13 | A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated p… |
CVE-2013-2972 | High | 7.5 | 2018-07-11 | IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors. IBM X-Force ID: 83868. |
CVE-2018-1129 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able t… |
CVE-2018-4858 | High | 7.8 | 2018-07-09 | A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated… |
CVE-2018-3762 | Medium | 4.3 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for… |
CVE-2018-1080 | High | 7.5 | 2018-07-03 | Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rule… |
CVE-2018-4845 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2016-9905 | High | 8.8 | 2018-06-11 | A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbir… |
CVE-2011-4181 | High | 7.5 | 2018-06-11 | A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE… |
CVE-2018-8922 | Medium | 6.5 | 2018-06-01 | Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecif… |
CVE-2016-10549 | Medium | 4.4 | 2018-05-31 | Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of t… |
CVE-2015-9236 | Medium | 5.3 | 2018-05-31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-… |
CVE-2015-9243 | Medium | 5.9 | 2018-05-29 | When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included s… |
CVE-2016-8656 | High | 7.0 | 2018-05-22 | Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege e… |
CVE-2009-5151 | Medium | 6.7 | 2018-05-11 | The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code… |
CVE-2009-5150 | Medium | 6.7 | 2018-05-11 | Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication wit… |
CVE-2013-6272 | High | 7.8 | 2018-05-02 | The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass intended access restr… |
CVE-2013-6739 | Medium | 5.4 | 2018-04-27 | IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855. |
CVE-2014-0881 | High | 7.4 | 2018-04-25 | The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive k… |
CVE-2016-9599 | High | 7.1 | 2018-04-24 | puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rul… |
CVE-2014-6109 | Medium | 5.3 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2016-10472 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 2… |
CVE-2016-10462 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 427, SD 430, SD 435… |
CVE-2016-10444 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/S… |
CVE-2016-10442 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, SDM630, MSM8976, MSM8937, SDM845, MSM8976, and MSM8952, whe… |
CVE-2016-10440 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, and SD 650/52, there is improper acc… |
CVE-2016-10422 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055… |
CVE-2016-10418 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210… |
CVE-2016-10417 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM960… |
CVE-2015-9209 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2015-9152 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD… |
CVE-2015-9140 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9… |
CVE-2014-10059 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, and SD 800, improper… |
CVE-2014-10053 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM890… |
CVE-2014-10050 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access contr… |
CVE-2015-0150 | Critical | 9.8 | 2018-04-12 | The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspeci… |
CVE-2016-9645 | Medium | 6.5 | 2018-04-10 | The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has… |
CVE-2014-1400 | Medium | 6.5 | 2018-04-10 | The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions… |
CVE-2014-1399 | Medium | 6.5 | 2018-04-10 | The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restr… |
CVE-2014-1398 | Medium | 6.5 | 2018-04-10 | The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restr… |
CVE-2017-18101 | Medium | 6.5 | 2018-04-10 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version… |
CVE-2016-8365 | Medium | 5.5 | 2018-04-03 | OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Softwar… |
CVE-2014-2048 | Critical | 9.8 | 2018-03-26 | The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation. |
CVE-2018-7520 | Critical | 9.8 | 2018-03-22 | An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, wh… |