CWE-284 · Improper Access Control (page 71)
Page 71 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3653 | Medium | 4.6 | 2019-10-09 | Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain acc… |
CVE-2019-12670 | Medium | 6.7 | 2019-09-25 | A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace cont… |
CVE-2019-12648 | High | 8.8 | 2019-09-25 | A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Gues… |
CVE-2019-15068 | Critical | 9.8 | 2019-09-25 | A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset admi… |
CVE-2019-6810 | High | 8.8 | 2019-09-17 | CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of c… |
CVE-2019-13919 | Medium | 4.3 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user c… |
CVE-2019-11899 | High | 7.5 | 2019-09-12 | An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Pr… |
CVE-2019-13656 | Critical | 9.8 | 2019-09-06 | An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to… |
CVE-2018-15513 | Medium | 5.3 | 2019-08-30 | Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role. |
CVE-2018-21007 | Critical | 9.8 | 2019-08-29 | The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads. |
CVE-2015-9337 | High | 7.5 | 2019-08-22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. |
CVE-2019-12627 | High | 7.5 | 2019-08-21 | A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2019-5036 | High | 7.5 | 2019-08-20 | An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafte… |
CVE-2017-18543 | Critical | 9.8 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. |
CVE-2018-20957 | High | 8.8 | 2019-08-08 | The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks. |
CVE-2016-10802 | High | 8.8 | 2019-08-07 | cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). |
CVE-2016-10799 | Medium | 5.5 | 2019-08-07 | cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). |
CVE-2016-10792 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141). |
CVE-2017-18457 | Medium | 4.4 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). |
CVE-2017-18421 | Low | 3.3 | 2019-08-02 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). |
CVE-2019-10938 | Critical | 9.8 | 2019-08-02 | A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100… |
CVE-2017-18416 | Medium | 5.5 | 2019-08-02 | cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). |
CVE-2017-18404 | Low | 3.1 | 2019-08-02 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). |
CVE-2017-18403 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10166 | High | 7.8 | 2019-08-02 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML()… |
CVE-2017-18385 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
CVE-2017-18384 | Low | 3.8 | 2019-08-02 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
CVE-2016-10820 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
CVE-2018-20938 | Low | 2.7 | 2019-08-01 | cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
CVE-2016-10830 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
CVE-2018-20930 | Medium | 6.5 | 2019-08-01 | cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). |
CVE-2016-10838 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
CVE-2016-10860 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
CVE-2016-10857 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
CVE-2016-10856 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
CVE-2016-10852 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
CVE-2015-9291 | High | 7.5 | 2019-08-01 | cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
CVE-2018-20890 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
CVE-2014-8183 | High | 7.4 | 2019-08-01 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access… |
CVE-2019-10189 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assig… |
CVE-2019-10188 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |
CVE-2019-10187 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-5452 | Low | 2.4 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although t… |
CVE-2019-10138 | High | 8.8 | 2019-07-30 | A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient ac… |
CVE-2019-10130 | Medium | 4.3 | 2019-07-30 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9… |
CVE-2017-18380 | High | 7.5 | 2019-07-30 | edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name. |
CVE-2019-9884 | Critical | 9.8 | 2019-07-25 | eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page. |
CVE-2018-13896 | High | 7.8 | 2019-07-22 | XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_SEC stage.. in Snap… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-10970 | Critical | 9.8 | 2019-07-11 | In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, una… |
CVE-2019-1010316 | High | 7.8 | 2019-07-11 | pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is… |
CVE-2019-9886 | High | 7.5 | 2019-07-11 | Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version… |
CVE-2018-19588 | High | 7.2 | 2019-07-11 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control. |
CVE-2018-17151 | Medium | 5.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. |
CVE-2018-11744 | High | 8.1 | 2019-07-11 | Cloudera Manager through 5.15 has Incorrect Access Control. |
CVE-2018-19576 | High | 8.1 | 2019-07-10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest… |
CVE-2018-19577 | Medium | 5.3 | 2019-07-10 | Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability t… |
CVE-2018-19496 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an in… |
CVE-2018-19494 | Medium | 4.3 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect a… |
CVE-2018-14833 | Medium | 5.9 | 2019-07-09 | Intuit Lacerte 2017 has Incorrect Access Control. |
CVE-2019-1890 | Medium | 6.5 | 2019-07-04 | A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch… |
CVE-2018-14859 | High | 8.1 | 2019-07-03 | Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to… |
CVE-2018-14864 | Medium | 6.5 | 2019-07-03 | Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authent… |
CVE-2018-14863 | High | 8.1 | 2019-07-03 | Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call privat… |
CVE-2019-13028 | High | 8.8 | 2019-06-28 | An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute a… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2018-14885 | Critical | 9.8 | 2019-06-28 | Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restor… |
CVE-2018-14867 | Medium | 5.3 | 2019-06-28 | Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post message… |
CVE-2019-1622 | Medium | 5.3 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve s… |
CVE-2019-1619 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass aut… |
CVE-2018-16553 | High | 7.2 | 2019-06-20 | In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin. |
CVE-2019-2729 | Critical | 9.8 | 2019-06-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6… |
CVE-2018-17148 | Critical | 9.8 | 2019-06-19 | An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before… |
CVE-2017-10721 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality e… |
CVE-2018-18958 | Medium | 6.5 | 2019-06-17 | OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. |
CVE-2019-10962 | Medium | 5.3 | 2019-06-13 | BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not… |
CVE-2019-10925 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially c… |
CVE-2018-10691 | High | 7.5 | 2019-06-07 | An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same fun… |
CVE-2018-5264 | Medium | 5.9 | 2019-06-07 | Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/d… |
CVE-2019-3895 | High | 8.0 | 2019-06-03 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause… |
CVE-2019-3567 | High | 8.1 | 2019-06-03 | In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious bina… |
CVE-2018-5406 | High | 8.8 | 2019-06-03 | The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism… |
CVE-2019-11896 | High | 7.1 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that… |
CVE-2019-11895 | Medium | 5.3 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a… |
CVE-2019-11894 | Medium | 5.7 | 2019-05-29 | A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in una… |
CVE-2019-11892 | High | 8.0 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in r… |
CVE-2018-13895 | High | 7.8 | 2019-05-24 | Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdra… |
CVE-2017-11365 | Critical | 9.8 | 2019-05-23 | Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The ty… |
CVE-2017-5212 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. |
CVE-2017-8340 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-6912 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-5863 | Critical | 9.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2019-11634 | Critical | 9.8 | 2019-05-22 | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. |
CVE-2019-1649 | Medium | 6.7 | 2019-05-13 | A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an aut… |
CVE-2019-3566 | Medium | 5.9 | 2019-05-10 | A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover pre… |
CVE-2019-6566 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an atta… |