CWE-284 · Improper Access Control (page 56)
Page 56 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-5350 | High | 7.5 | 2018-03-19 | In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By… |
CVE-2016-8629 | Medium | 6.5 | 2018-03-12 | Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An atta… |
CVE-2018-1069 | High | 7.1 | 2018-03-09 | Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and… |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-12191 | High | 7.4 | 2018-02-28 | A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Rem… |
CVE-2018-1168 | High | 7.8 | 2018-02-21 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain… |
CVE-2016-8529 | High | 7.6 | 2018-02-15 | A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier… |
CVE-2018-0119 | Medium | 4.7 | 2018-02-08 | A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and vi… |
CVE-2014-5279 | High | 8.8 | 2018-02-06 | The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attack… |
CVE-2016-0342 | Medium | 5.4 | 2018-02-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary r… |
CVE-2017-18035 | Medium | 4.3 | 2018-02-02 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permis… |
CVE-2014-9504 | High | 7.5 | 2018-02-01 | The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors r… |
CVE-2014-3519 | Medium | 6.5 | 2018-02-01 | The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local cont… |
CVE-2016-6598 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a met… |
CVE-2017-9513 | Medium | 5.4 | 2018-01-29 | Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & re… |
CVE-2015-3888 | High | 7.5 | 2018-01-12 | Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL. |
CVE-2016-9722 | Medium | 4.2 | 2018-01-10 | IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. I… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2015-8008 | High | 7.5 | 2017-12-29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP addre… |
CVE-2015-3302 | High | 7.5 | 2017-12-29 | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtai… |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-5254 | High | 8.8 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for o… |
CVE-2017-15891 | Medium | 6.5 | 2017-12-08 | Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event v… |
CVE-2017-12340 | Medium | 4.2 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series… |
CVE-2017-14031 | High | 7.8 | 2017-11-06 | An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the… |
CVE-2017-12262 | High | 8.8 | 2017-11-02 | A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthen… |
CVE-2015-9245 | Critical | 9.8 | 2017-10-31 | Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to loa… |
CVE-2014-3624 | Critical | 9.8 | 2017-10-30 | Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CO… |
CVE-2013-4246 | High | 8.8 | 2017-10-30 | libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a… |
CVE-2010-2232 | High | 7.5 | 2017-10-23 | In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file. |
CVE-2012-4380 | High | 7.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unsp… |
CVE-2012-4379 | Medium | 6.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjackin… |
CVE-2016-5714 | High | 7.2 | 2017-10-18 | Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechan… |
CVE-2014-2277 | High | 7.1 | 2017-10-17 | The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a sy… |
CVE-2014-9489 | High | 8.8 | 2017-10-17 | The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in… |
CVE-2014-9148 | Critical | 9.8 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator func… |
CVE-2016-10514 | Medium | 6.5 | 2017-10-10 | url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a "… |
CVE-2017-8448 | High | 8.8 | 2017-09-29 | An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that resu… |
CVE-2017-8447 | Medium | 6.5 | 2017-09-29 | An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster… |
CVE-2015-1336 | High | 7.8 | 2017-09-28 | The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges vi… |
CVE-2015-7315 | Medium | 5.9 | 2017-09-25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new… |
CVE-2015-1854 | High | 7.5 | 2017-09-19 | 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. |
CVE-2015-0110 | Medium | 6.5 | 2017-09-15 | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intend… |
CVE-2015-3163 | Medium | 4.3 | 2017-09-06 | The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power ty… |
CVE-2014-8677 | Medium | 5.3 | 2017-08-31 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a… |
CVE-2016-8752 | High | 7.5 | 2017-08-29 | Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js… |
CVE-2015-4649 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3657 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privil… |
CVE-2015-3654 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3653 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the u… |
CVE-2014-9513 | Critical | 9.8 | 2017-08-28 | Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code. |
CVE-2014-8168 | Medium | 6.1 | 2017-08-28 | Red Hat Satellite 6 allows local users to access mongod and delete pulp_database. |
CVE-2015-5293 | Medium | 5.9 | 2017-08-24 | Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow… |
CVE-2016-10382 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, access control to the I2C bus is not sufficient. |
CVE-2015-9064 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS s… |
CVE-2015-9047 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup. |
CVE-2015-9040 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API. |
CVE-2015-2687 | Medium | 4.7 | 2017-08-09 | OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissi… |
CVE-2017-6866 | Medium | 6.5 | 2017-08-07 | A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote… |
CVE-2014-9831 | High | 8.8 | 2017-08-07 | coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file. |
CVE-2014-9830 | High | 8.8 | 2017-08-07 | coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file. |
CVE-2014-9828 | High | 8.8 | 2017-08-07 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file. |
CVE-2014-9827 | High | 8.8 | 2017-08-07 | coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file. |
CVE-2015-7887 | High | 8.1 | 2017-08-07 | NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups. |
CVE-2017-7928 | Critical | 10.0 | 2017-08-07 | An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R2… |
CVE-2016-10042 | High | 7.5 | 2017-06-29 | Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the s… |
CVE-2016-6342 | High | 7.5 | 2017-06-27 | elog 3.1.1 allows remote attackers to post data as any username in the logbook. |
CVE-2016-5414 | High | 7.5 | 2017-06-27 | FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. |
CVE-2016-4383 | High | 8.4 | 2017-06-27 | The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause… |
CVE-2015-8697 | Medium | 5.5 | 2017-06-27 | stalin 0.11-5 allows local users to write to arbitrary files. |
CVE-2015-7898 | Medium | 5.5 | 2017-06-27 | Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-7895 | Medium | 5.5 | 2017-06-27 | Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-3840 | Medium | 5.5 | 2017-06-27 | The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS mes… |
CVE-2017-7918 | Medium | 6.8 | 2017-06-21 | An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotel… |
CVE-2016-10335 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. |
CVE-2016-10334 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. |
CVE-2016-10333 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. |
CVE-2015-9029 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. |
CVE-2015-9024 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. |
CVE-2015-9021 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled. |
CVE-2014-9961 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection. |
CVE-2016-7833 | High | 7.5 | 2017-06-09 | Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspeci… |
CVE-2016-7824 | High | 8.8 | 2017-06-09 | Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via uns… |
CVE-2016-7811 | High | 8.8 | 2017-06-09 | Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations v… |
CVE-2016-7807 | High | 7.5 | 2017-06-09 | I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into… |
CVE-2016-7801 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors. |
CVE-2016-4910 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters… |
CVE-2016-4908 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unsp… |
CVE-2016-6098 | High | 8.1 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or mo… |
CVE-2015-2692 | Critical | 10.0 | 2017-06-08 | AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. |
CVE-2016-3112 | High | 7.5 | 2017-06-08 | client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote auth… |
CVE-2016-3107 | Medium | 5.5 | 2017-06-08 | The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allow… |
CVE-2015-3295 | Medium | 5.3 | 2017-06-07 | markdown-it before 4.1.0 does not block data: URLs. |
CVE-2016-6089 | Medium | 5.5 | 2017-06-07 | IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper ac… |
CVE-2016-0768 | High | 7.5 | 2017-06-06 | PostgreSQL PL/Java after 9.0 does not honor access controls on large objects. |
CVE-2015-9006 | High | 7.8 | 2017-06-06 | In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. |
CVE-2017-8438 | High | 8.8 | 2017-06-05 | Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specif… |
CVE-2017-6016 | High | 7.3 | 2017-05-19 | An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affec… |
CVE-2016-10237 | High | 7.8 | 2017-05-16 | If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF u… |
CVE-2016-10370 | High | 7.5 | 2017-05-11 | An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow f… |