CWE-285 · Improper Authorization (page 13)
Page 13 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2019 | High | 7.3 | 2022-06-09 | A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2022-30746 | High | 7.5 | 2022-06-07 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. |
CVE-2022-30730 | Medium | 4.6 | 2022-06-07 | Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication. |
CVE-2022-30722 | Medium | 6.2 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account. |
CVE-2022-30717 | Medium | 4.0 | 2022-06-07 | Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink. |
CVE-2022-31025 | Low | 2.6 | 2022-06-07 | Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` br… |
CVE-2022-29236 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access r… |
CVE-2022-29234 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a l… |
CVE-2022-29233 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access c… |
CVE-2022-26773 | High | 7.1 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for w… |
CVE-2022-26857 | Critical | 9.0 | 2022-05-26 | Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges… |
CVE-2021-27772 | High | 7.1 | 2022-05-12 | Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations… |
CVE-2022-0027 | Medium | 4.3 | 2022-05-11 | An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email rep… |
CVE-2021-43939 | High | 8.8 | 2022-04-28 | Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired… |
CVE-2022-0993 | High | 8.1 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-28776 | Medium | 5.9 | 2022-04-11 | Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interact… |
CVE-2022-1224 | Medium | 6.5 | 2022-04-04 | Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-0406 | Medium | 4.3 | 2022-04-03 | Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2022-0860 | Critical | 9.1 | 2022-03-11 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. |
CVE-2022-0821 | Medium | 6.5 | 2022-03-11 | Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-0829 | High | 8.1 | 2022-03-02 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-21196 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2022-0587 | Medium | 6.5 | 2022-02-15 | Improper Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-24002 | Medium | 4.0 | 2022-02-11 | Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity. |
CVE-2021-42000 | Medium | 5.3 | 2022-02-10 | When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple paral… |
CVE-2021-44204 | High | 7.8 | 2022-02-04 | Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2021-28501 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2021-28500 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2022-22288 | High | 7.5 | 2022-01-10 | Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist. |
CVE-2022-22272 | Medium | 4.0 | 2022-01-10 | Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission |
CVE-2022-22269 | Medium | 4.0 | 2022-01-10 | Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC addr… |
CVE-2022-22268 | Medium | 6.1 | 2022-01-10 | Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX… |
CVE-2022-22267 | Medium | 4.0 | 2022-01-10 | Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information. |
CVE-2020-9061 | Medium | 6.5 | 2022-01-10 | Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon… |
CVE-2021-3837 | Medium | 6.1 | 2022-01-03 | openwhyd is vulnerable to Improper Authorization |
CVE-2021-43847 | Medium | 6.5 | 2021-12-20 | HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauth… |
CVE-2021-25521 | Medium | 4.0 | 2021-12-08 | Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet. |
CVE-2021-42126 | High | 8.8 | 2021-12-07 | An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privi… |
CVE-2021-36311 | Medium | 6.0 | 2021-11-23 | Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit… |
CVE-2021-42338 | Critical | 9.8 | 2021-11-19 | 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in… |
CVE-2021-42337 | Medium | 4.3 | 2021-11-16 | The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker ca… |
CVE-2021-25507 | Medium | 5.7 | 2021-11-05 | Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to acce… |
CVE-2021-25973 | Medium | 6.5 | 2021-11-02 | In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happen… |
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-41313 | Medium | 4.3 | 2021-11-01 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Imprope… |
CVE-2021-41308 | Medium | 6.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via… |
CVE-2021-31384 | High | 7.2 | 2021-10-19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Ne… |
CVE-2021-38486 | High | 8.0 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements… |
CVE-2021-42336 | Medium | 4.3 | 2021-10-15 | The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and… |
CVE-2021-42332 | Medium | 4.3 | 2021-10-15 | The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the… |
CVE-2021-42331 | Medium | 5.4 | 2021-10-15 | The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can acces… |
CVE-2021-42330 | High | 8.8 | 2021-10-15 | The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can acce… |
CVE-2021-41137 | High | 8.8 | 2021-10-13 | Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves b… |
CVE-2021-33723 | Medium | 6.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user withou… |
CVE-2021-39317 | High | 8.8 | 2021-10-11 | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX… |
CVE-2021-41976 | Medium | 5.3 | 2021-10-08 | Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book li… |
CVE-2021-41975 | High | 7.5 | 2021-10-08 | TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system witho… |
CVE-2021-41974 | Critical | 9.1 | 2021-10-08 | Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books wi… |
CVE-2021-41568 | Medium | 5.3 | 2021-10-08 | Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and… |
CVE-2021-41564 | Medium | 5.3 | 2021-10-08 | Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily wit… |
CVE-2021-25499 | High | 7.1 | 2021-10-06 | Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Gal… |
CVE-2021-41100 | High | 7.4 | 2021-10-04 | Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of… |
CVE-2021-41093 | High | 7.4 | 2021-10-04 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing t… |
CVE-2021-25460 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService. |
CVE-2021-25459 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService. |
CVE-2021-3049 | Low | 2.6 | 2021-09-08 | An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read p… |
CVE-2021-28567 | Medium | 6.5 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the custom… |
CVE-2021-36037 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-36029 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2021-27663 | High | 8.2 | 2021-08-30 | A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authoriz… |
CVE-2021-28626 | Low | 3.7 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users… |
CVE-2021-3616 | Critical | 9.4 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content an… |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-36276 | High | 8.8 | 2021-08-09 | Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of s… |
CVE-2021-35964 | High | 7.3 | 2021-07-19 | The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management f… |
CVE-2021-32688 | High | 8.8 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tok… |
CVE-2021-1576 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-1574 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-25433 | Medium | 5.5 | 2021-07-08 | Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory r… |
CVE-2021-32523 | Critical | 9.1 | 2021-07-07 | Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Sugges… |
CVE-2021-28563 | Medium | 6.5 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create… |
CVE-2021-3044 | Critical | 9.8 | 2021-06-22 | An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR se… |
CVE-2021-23140 | Critical | 9.9 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator. T… |
CVE-2021-23136 | Medium | 6.5 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an unprivileged Command Centre Operator. This… |
CVE-2021-25417 | High | 7.5 | 2021-06-11 | Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage. |
CVE-2021-25399 | High | 7.1 | 2021-06-11 | Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. |
CVE-2020-25716 | High | 8.1 | 2021-06-07 | A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific… |
CVE-2020-1690 | Medium | 6.5 | 2021-06-07 | An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege esc… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-32619 | Critical | 9.8 | 2021-05-28 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported thro… |
CVE-2020-10716 | Medium | 6.5 | 2021-05-27 | A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Sate… |
CVE-2021-24195 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin befor… |
CVE-2021-24194 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin b… |
CVE-2021-24193 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12… |
CVE-2021-24192 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (… |
CVE-2021-24191 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin be… |
CVE-2021-24190 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before… |
CVE-2021-24189 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugi… |