CWE-284 · Improper Access Control (page 72)
Page 72 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6544 | Medium | 5.6 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrat… |
CVE-2019-5014 | Medium | 6.5 | 2019-05-08 | An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can… |
CVE-2019-1695 | Medium | 6.5 | 2019-05-03 | A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2019-3936 | High | 7.5 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389. The request wi… |
CVE-2019-3935 | Critical | 9.1 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to co… |
CVE-2019-3934 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to log… |
CVE-2019-3933 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide… |
CVE-2019-3928 | Medium | 5.3 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7… |
CVE-2019-3927 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.1… |
CVE-2019-10950 | Critical | 9.8 | 2019-04-30 | Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet service… |
CVE-2019-7476 | High | 8.1 | 2019-04-26 | A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability aff… |
CVE-2016-1587 | High | 7.1 | 2019-04-22 | The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the orig… |
CVE-2019-1805 | Medium | 4.3 | 2019-04-18 | A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could al… |
CVE-2019-1686 | High | 8.6 | 2019-04-17 | A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauth… |
CVE-2019-3845 | High | 8.0 | 2019-04-11 | A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Sate… |
CVE-2019-0041 | High | 8.6 | 2019-04-10 | On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail… |
CVE-2019-0036 | Critical | 9.8 | 2019-04-10 | When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignore… |
CVE-2019-8456 | Medium | 5.9 | 2019-04-09 | Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to succe… |
CVE-2019-6140 | Critical | 9.8 | 2019-04-09 | A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration pr… |
CVE-2018-15640 | High | 8.8 | 2019-04-09 | Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craf… |
CVE-2018-15631 | Medium | 6.5 | 2019-04-09 | Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-… |
CVE-2017-7912 | Critical | 9.8 | 2019-04-08 | Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gai… |
CVE-2019-6554 | High | 7.5 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. |
CVE-2019-7475 | Critical | 9.8 | 2019-04-02 | A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing s… |
CVE-2019-1759 | Medium | 5.3 | 2019-03-28 | A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated… |
CVE-2017-9626 | Critical | 9.8 | 2019-03-27 | Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This up… |
CVE-2018-12546 | Medium | 6.5 | 2019-03-27 | In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the ret… |
CVE-2010-5305 | Critical | 9.8 | 2019-03-26 | The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controll… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2018-16838 | Medium | 5.4 | 2019-03-25 | A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side… |
CVE-2019-1763 | High | 7.5 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-1690 | Medium | 6.5 | 2019-03-11 | A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent atta… |
CVE-2019-1601 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-6520 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. |
CVE-2019-1666 | Medium | 5.3 | 2019-02-21 | A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service… |
CVE-2019-1664 | High | 7.8 | 2019-02-21 | A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluste… |
CVE-2013-5654 | Critical | 9.1 | 2019-02-15 | Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage |
CVE-2019-1660 | Medium | 5.3 | 2019-02-07 | A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attack… |
CVE-2019-6517 | Medium | 6.8 | 2019-02-06 | BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric… |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2019-1653 | High | 7.5 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remo… |
CVE-2019-1647 | High | 8.0 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to ot… |
CVE-2018-15459 | Medium | 6.5 | 2019-01-23 | A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional pr… |
CVE-2018-19634 | High | 7.5 | 2019-01-22 | CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information. |
CVE-2018-15466 | Medium | 5.3 | 2019-01-11 | A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remo… |
CVE-2018-0484 | Medium | 5.3 | 2019-01-10 | A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual rout… |
CVE-2018-13816 | Critical | 10.0 | 2018-12-12 | A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. S… |
CVE-2018-7364 | Critical | 9.8 | 2018-12-07 | All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access c… |
CVE-2018-16476 | High | 7.5 | 2018-11-30 | A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using… |
CVE-2018-17953 | High | 7.5 | 2018-11-27 | A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_ac… |
CVE-2018-7362 | High | 7.5 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perfor… |
CVE-2018-15394 | Critical | 9.8 | 2018-11-08 | A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authent… |
CVE-2018-17931 | Medium | 6.8 | 2018-10-30 | If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be able to alter scrip… |
CVE-2018-16466 | High | 8.1 | 2018-10-30 | Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens. |
CVE-2018-17908 | High | 7.8 | 2018-10-29 | WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installatio… |
CVE-2018-17921 | High | 8.8 | 2018-10-24 | SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without human interaction. |
CVE-2018-15395 | Medium | 5.4 | 2018-10-17 | A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjac… |
CVE-2018-15398 | Medium | 4.0 | 2018-10-05 | A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2018-15372 | High | 8.1 | 2018-10-05 | A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Sof… |
CVE-2018-15371 | Medium | 6.7 | 2018-10-05 | A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain u… |
CVE-2018-0447 | Medium | 5.3 | 2018-10-05 | A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, r… |
CVE-2018-0436 | High | 8.7 | 2018-10-05 | A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other tha… |
CVE-2018-14804 | Critical | 9.8 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution. |
CVE-2018-15611 | Medium | 6.3 | 2018-09-27 | A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local syste… |
CVE-2018-10500 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must… |
CVE-2018-15610 | High | 7.3 | 2018-09-12 | A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected ve… |
CVE-2018-7791 | Critical | 9.8 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2016-7048 | High | 8.1 | 2018-08-20 | The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by le… |
CVE-2018-0428 | Medium | 6.7 | 2018-08-15 | A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to… |
CVE-2018-10630 | Critical | 9.8 | 2018-08-10 | For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there i… |
CVE-2018-11456 | Medium | 5.8 | 2018-08-07 | A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device could send speciall… |
CVE-2017-7497 | Medium | 4.1 | 2018-07-27 | The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage vol… |
CVE-2017-12171 | Medium | 6.5 | 2018-07-26 | A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be par… |
CVE-2017-2664 | Medium | 6.5 | 2018-07-26 | CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms… |
CVE-2018-10905 | High | 7.8 | 2018-07-24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile… |
CVE-2018-0343 | High | 8.8 | 2018-07-18 | A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary cod… |
CVE-2016-6543 | Medium | 5.9 | 2018-07-13 | A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated p… |
CVE-2013-2972 | High | 7.5 | 2018-07-11 | IBM WebSphere Cast Iron 6.3 allows remote attackers to bypass intended access restrictions via unspecified vectors. IBM X-Force ID: 83868. |
CVE-2018-1129 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able t… |
CVE-2018-4858 | High | 7.8 | 2018-07-09 | A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated… |
CVE-2018-3762 | Medium | 4.3 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for… |
CVE-2018-1080 | High | 7.5 | 2018-07-03 | Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rule… |
CVE-2018-4845 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2016-9905 | High | 8.8 | 2018-06-11 | A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbir… |
CVE-2011-4181 | High | 7.5 | 2018-06-11 | A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE… |
CVE-2018-8922 | Medium | 6.5 | 2018-06-01 | Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecif… |
CVE-2016-10549 | Medium | 4.4 | 2018-05-31 | Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of t… |
CVE-2015-9236 | Medium | 5.3 | 2018-05-31 | Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-… |
CVE-2015-9243 | Medium | 5.9 | 2018-05-29 | When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included s… |
CVE-2016-8656 | High | 7.0 | 2018-05-22 | Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege e… |
CVE-2009-5151 | Medium | 6.7 | 2018-05-11 | The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code… |
CVE-2009-5150 | Medium | 6.7 | 2018-05-11 | Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication wit… |
CVE-2013-6272 | High | 7.8 | 2018-05-02 | The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass intended access restr… |
CVE-2013-6739 | Medium | 5.4 | 2018-04-27 | IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855. |
CVE-2014-0881 | High | 7.4 | 2018-04-25 | The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive k… |
CVE-2016-9599 | High | 7.1 | 2018-04-24 | puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rul… |
CVE-2014-6109 | Medium | 5.3 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2016-10472 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 2… |