CWE-284 · Improper Access Control (page 73)
Page 73 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10462 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 427, SD 430, SD 435… |
CVE-2016-10444 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/S… |
CVE-2016-10442 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, SDM630, MSM8976, MSM8937, SDM845, MSM8976, and MSM8952, whe… |
CVE-2016-10440 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, and SD 650/52, there is improper acc… |
CVE-2016-10422 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055… |
CVE-2016-10418 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210… |
CVE-2016-10417 | High | 8.1 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM960… |
CVE-2015-9209 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2015-9152 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD… |
CVE-2015-9140 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9… |
CVE-2014-10059 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, and SD 800, improper… |
CVE-2014-10053 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM890… |
CVE-2014-10050 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access contr… |
CVE-2015-0150 | Critical | 9.8 | 2018-04-12 | The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspeci… |
CVE-2016-9645 | Medium | 6.5 | 2018-04-10 | The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has… |
CVE-2014-1400 | Medium | 6.5 | 2018-04-10 | The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions… |
CVE-2014-1399 | Medium | 6.5 | 2018-04-10 | The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restr… |
CVE-2014-1398 | Medium | 6.5 | 2018-04-10 | The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restr… |
CVE-2017-18101 | Medium | 6.5 | 2018-04-10 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version… |
CVE-2016-8365 | Medium | 5.5 | 2018-04-03 | OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Softwar… |
CVE-2014-2048 | Critical | 9.8 | 2018-03-26 | The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation. |
CVE-2018-7520 | Critical | 9.8 | 2018-03-22 | An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, wh… |
CVE-2018-4844 | Medium | 6.7 | 2018-03-20 | A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insuff… |
CVE-2014-2884 | Low | 3.3 | 2018-03-19 | The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information ab… |
CVE-2015-5350 | High | 7.5 | 2018-03-19 | In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By… |
CVE-2016-8629 | Medium | 6.5 | 2018-03-12 | Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An atta… |
CVE-2018-1069 | High | 7.1 | 2018-03-09 | Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and… |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-12191 | High | 7.4 | 2018-02-28 | A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Rem… |
CVE-2018-1168 | High | 7.8 | 2018-02-21 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain… |
CVE-2016-8529 | High | 7.6 | 2018-02-15 | A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier… |
CVE-2018-0119 | Medium | 4.7 | 2018-02-08 | A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and vi… |
CVE-2014-5279 | High | 8.8 | 2018-02-06 | The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attack… |
CVE-2016-0342 | Medium | 5.4 | 2018-02-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary r… |
CVE-2017-18035 | Medium | 4.3 | 2018-02-02 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permis… |
CVE-2014-9504 | High | 7.5 | 2018-02-01 | The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors r… |
CVE-2014-3519 | Medium | 6.5 | 2018-02-01 | The open_by_handle_at function in vzkernel before 042stab090.5 in the OpenVZ modification for the Linux kernel 2.6.32, when using simfs, might allow local cont… |
CVE-2016-6598 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a met… |
CVE-2017-9513 | Medium | 5.4 | 2018-01-29 | Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & re… |
CVE-2015-3888 | High | 7.5 | 2018-01-12 | Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL. |
CVE-2016-9722 | Medium | 4.2 | 2018-01-10 | IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. I… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2015-8008 | High | 7.5 | 2017-12-29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP addre… |
CVE-2015-3302 | High | 7.5 | 2017-12-29 | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtai… |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-5254 | High | 8.8 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for o… |
CVE-2017-15891 | Medium | 6.5 | 2017-12-08 | Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event v… |
CVE-2017-12340 | Medium | 4.2 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series… |
CVE-2017-14031 | High | 7.8 | 2017-11-06 | An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the… |
CVE-2017-12262 | High | 8.8 | 2017-11-02 | A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthen… |
CVE-2015-9245 | Critical | 9.8 | 2017-10-31 | Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to loa… |
CVE-2014-3624 | Critical | 9.8 | 2017-10-30 | Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CO… |
CVE-2013-4246 | High | 8.8 | 2017-10-30 | libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a… |
CVE-2010-2232 | High | 7.5 | 2017-10-23 | In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file. |
CVE-2012-4380 | High | 7.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unsp… |
CVE-2012-4379 | Medium | 6.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjackin… |
CVE-2016-5714 | High | 7.2 | 2017-10-18 | Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechan… |
CVE-2014-2277 | High | 7.1 | 2017-10-17 | The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a sy… |
CVE-2014-9489 | High | 8.8 | 2017-10-17 | The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in… |
CVE-2014-9148 | Critical | 9.8 | 2017-10-16 | Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator func… |
CVE-2016-10514 | Medium | 6.5 | 2017-10-10 | url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a "… |
CVE-2017-8448 | High | 8.8 | 2017-09-29 | An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that resu… |
CVE-2017-8447 | Medium | 6.5 | 2017-09-29 | An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster… |
CVE-2015-1336 | High | 7.8 | 2017-09-28 | The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges vi… |
CVE-2015-7315 | Medium | 5.9 | 2017-09-25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new… |
CVE-2015-1854 | High | 7.5 | 2017-09-19 | 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. |
CVE-2015-0110 | Medium | 6.5 | 2017-09-15 | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intend… |
CVE-2015-3163 | Medium | 4.3 | 2017-09-06 | The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power ty… |
CVE-2014-8677 | Medium | 5.3 | 2017-08-31 | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a… |
CVE-2016-8752 | High | 7.5 | 2017-08-29 | Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js… |
CVE-2015-4649 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3657 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privil… |
CVE-2015-3654 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified… |
CVE-2015-3653 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the u… |
CVE-2014-9513 | Critical | 9.8 | 2017-08-28 | Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code. |
CVE-2014-8168 | Medium | 6.1 | 2017-08-28 | Red Hat Satellite 6 allows local users to access mongod and delete pulp_database. |
CVE-2015-5293 | Medium | 5.9 | 2017-08-24 | Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow… |
CVE-2016-10382 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, access control to the I2C bus is not sufficient. |
CVE-2015-9064 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS s… |
CVE-2015-9047 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup. |
CVE-2015-9040 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API. |
CVE-2015-2687 | Medium | 4.7 | 2017-08-09 | OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissi… |
CVE-2017-6866 | Medium | 6.5 | 2017-08-07 | A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote… |
CVE-2014-9831 | High | 8.8 | 2017-08-07 | coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file. |
CVE-2014-9830 | High | 8.8 | 2017-08-07 | coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file. |
CVE-2014-9828 | High | 8.8 | 2017-08-07 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file. |
CVE-2014-9827 | High | 8.8 | 2017-08-07 | coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file. |
CVE-2015-7887 | High | 8.1 | 2017-08-07 | NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups. |
CVE-2017-7928 | Critical | 10.0 | 2017-08-07 | An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R2… |
CVE-2016-10042 | High | 7.5 | 2017-06-29 | Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the s… |
CVE-2016-6342 | High | 7.5 | 2017-06-27 | elog 3.1.1 allows remote attackers to post data as any username in the logbook. |
CVE-2016-5414 | High | 7.5 | 2017-06-27 | FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. |
CVE-2016-4383 | High | 8.4 | 2017-06-27 | The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause… |
CVE-2015-8697 | Medium | 5.5 | 2017-06-27 | stalin 0.11-5 allows local users to write to arbitrary files. |
CVE-2015-7898 | Medium | 5.5 | 2017-06-27 | Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-7895 | Medium | 5.5 | 2017-06-27 | Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). |
CVE-2015-3840 | Medium | 5.5 | 2017-06-27 | The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS mes… |
CVE-2017-7918 | Medium | 6.8 | 2017-06-21 | An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotel… |
CVE-2016-10335 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. |
CVE-2016-10334 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. |