CWE-285 · Improper Authorization (page 14)
Page 14 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24188 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin befo… |
CVE-2021-28799 | Critical | 10.0 | 2021-05-13 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote… |
CVE-2020-17517 | High | 7.5 | 2021-04-27 | The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access… |
CVE-2021-25382 | Medium | 6.1 | 2021-04-23 | An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents in Secure Folder v… |
CVE-2021-0260 | High | 7.3 | 2021-04-22 | An improper authorization vulnerability in the Simple Network Management Protocol daemon (snmpd) service of Juniper Networks Junos OS leads an unauthenticated… |
CVE-2021-21096 | Medium | 5.5 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Improper Authorization vulnerability in the Genuine Software Service. A… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |
CVE-2021-25374 | High | 8.6 | 2021-04-09 | An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9… |
CVE-2021-25373 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2… |
CVE-2021-21432 | High | 7.5 | 2021-04-09 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enabl… |
CVE-2021-22865 | Medium | 6.5 | 2021-04-02 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication… |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-25354 | Low | 3.3 | 2021-03-25 | Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink. |
CVE-2021-25353 | Medium | 5.5 | 2021-03-25 | Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes applicat… |
CVE-2021-25352 | Medium | 5.5 | 2021-03-25 | Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the… |
CVE-2021-25351 | Low | 3.2 | 2021-03-25 | Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user… |
CVE-2019-14828 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to cre… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2020-27779 | High | 7.5 | 2021-03-03 | A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ra… |
CVE-2021-22863 | High | 8.1 | 2021-03-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify… |
CVE-2021-22862 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to… |
CVE-2021-22861 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to un… |
CVE-2021-21511 | High | 8.1 | 2021-02-15 | Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentiall… |
CVE-2021-21026 | Medium | 5.3 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integration… |
CVE-2020-24674 | High | 8.8 | 2020-12-22 | In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execu… |
CVE-2020-8920 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the Filter… |
CVE-2020-8919 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST AP… |
CVE-2020-26246 | High | 7.7 | 2020-12-03 | Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the ap… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-24405 | Medium | 4.3 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could… |
CVE-2020-24404 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability co… |
CVE-2020-24403 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability… |
CVE-2020-24431 | Medium | 4.4 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security fea… |
CVE-2020-1908 | Medium | 4.6 | 2020-11-03 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
CVE-2020-26183 | Medium | 6.8 | 2020-10-16 | Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulner… |
CVE-2020-9048 | High | 7.1 | 2020-10-08 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker… |
CVE-2020-7530 | High | 8.8 | 2020-09-16 | A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to executable code fol… |
CVE-2020-16096 | Critical | 9.9 | 2020-09-15 | In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70… |
CVE-2020-6311 | Medium | 6.5 | 2020-09-09 | Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform neces… |
CVE-2020-10517 | Medium | 4.3 | 2020-08-27 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of… |
CVE-2020-3394 | High | 7.8 | 2020-08-27 | A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an a… |
CVE-2020-7583 | High | 7.8 | 2020-08-14 | A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does… |
CVE-2020-3386 | High | 8.8 | 2020-07-31 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with a low-privileged accoun… |
CVE-2020-3374 | Critical | 9.9 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, e… |
CVE-2020-14486 | Medium | 6.3 | 2020-07-29 | An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow… |
CVE-2020-3150 | Medium | 5.9 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco Small Business RV110W and RV215W Series Routers could allow an unauthenticated, remote attacker… |
CVE-2020-5356 | High | 7.7 | 2020-07-06 | Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability… |
CVE-2020-15087 | High | 7.4 | 2020-06-30 | In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations… |
CVE-2020-15084 | High | 7.7 | 2020-06-30 | In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms i… |
CVE-2020-10736 | High | 8.0 | 2020-06-22 | An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access… |
CVE-2020-5362 | High | 7.1 | 2020-06-10 | Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized act… |
CVE-2020-3267 | High | 7.1 | 2020-06-03 | A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availabi… |
CVE-2020-10516 | Critical | 9.8 | 2020-06-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gai… |
CVE-2020-10620 | Critical | 9.8 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly… |
CVE-2020-1998 | Medium | 5.4 | 2020-05-13 | An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the acc… |
CVE-2020-10686 | Medium | 4.1 | 2020-05-04 | A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could… |
CVE-2020-5333 | Medium | 4.3 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user cou… |
CVE-2020-1745 | High | 8.6 | 2020-04-28 | A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before… |
CVE-2019-13554 | High | 8.8 | 2020-04-07 | GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credentials. GE recommen… |
CVE-2020-5289 | Medium | 6.8 | 2020-03-30 | In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at le… |
CVE-2020-5275 | High | 7.6 | 2020-03-30 | In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as so… |
CVE-2019-14883 | Medium | 5.3 | 2020-03-18 | A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disable… |
CVE-2020-1720 | Low | 3.1 | 2020-03-17 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use… |
CVE-2020-5240 | High | 7.6 | 2020-03-13 | In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not requir… |
CVE-2020-5250 | High | 7.6 | 2020-03-05 | In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's add… |
CVE-2020-5251 | High | 7.7 | 2020-03-04 | In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionT… |
CVE-2020-5318 | High | 7.5 | 2020-02-06 | Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability… |
CVE-2020-8119 | Medium | 4.3 | 2020-02-04 | Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. |
CVE-2019-15610 | Medium | 4.3 | 2020-02-04 | Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. |
CVE-2020-5232 | High | 8.7 | 2020-01-31 | A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consen… |
CVE-2020-5231 | Medium | 4.8 | 2020-01-30 | In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. RO… |
CVE-2020-5206 | High | 8.7 | 2020-01-30 | In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if… |
CVE-2019-7479 | High | 7.2 | 2019-12-31 | A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version… |
CVE-2019-7489 | Critical | 9.8 | 2019-12-23 | A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Securit… |
CVE-2019-18827 | Medium | 5.9 | 2019-12-16 | On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is… |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2019-15990 | Medium | 5.3 | 2019-11-26 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view… |
CVE-2019-3641 | Medium | 4.5 | 2019-11-13 | Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated… |
CVE-2019-3764 | Medium | 4.3 | 2019-11-07 | Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vul… |
CVE-2019-17631 | Critical | 9.1 | 2019-10-17 | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. |
CVE-2019-12671 | High | 7.8 | 2019-09-25 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute command… |
CVE-2019-13528 | Medium | 4.4 | 2019-09-24 | A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (… |
CVE-2019-13550 | Critical | 9.8 | 2019-09-18 | In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control… |
CVE-2019-12635 | Medium | 4.3 | 2019-09-05 | A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain… |
CVE-2019-1907 | High | 8.8 | 2019-08-21 | A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration… |
CVE-2019-1863 | High | 8.1 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-14670 | Critical | 9.8 | 2019-08-15 | Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. |
CVE-2019-13416 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster igno… |
CVE-2019-1934 | High | 8.8 | 2019-08-07 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elev… |
CVE-2019-1912 | Critical | 9.1 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |
CVE-2018-20945 | Medium | 5.7 | 2019-08-01 | bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354). |
CVE-2018-20927 | Low | 3.8 | 2019-08-01 | cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382). |
CVE-2016-10848 | High | 7.2 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81). |
CVE-2016-10859 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65). |
CVE-2018-17210 | High | 8.8 | 2019-07-20 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete… |
CVE-2018-19581 | High | 7.5 | 2019-07-10 | GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that… |
CVE-2018-19578 | Medium | 6.5 | 2019-07-10 | GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Trac… |
CVE-2018-19569 | High | 8.8 | 2019-07-10 | GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows… |