CWE-285 · Improper Authorization (page 15)
Page 15 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0587 | Medium | 6.5 | 2022-02-15 | Improper Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-24002 | Medium | 4.0 | 2022-02-11 | Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity. |
CVE-2021-42000 | Medium | 5.3 | 2022-02-10 | When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple paral… |
CVE-2021-44204 | High | 7.8 | 2022-02-04 | Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2021-28501 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2021-28500 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2022-22288 | High | 7.5 | 2022-01-10 | Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist. |
CVE-2022-22272 | Medium | 4.0 | 2022-01-10 | Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission |
CVE-2022-22269 | Medium | 4.0 | 2022-01-10 | Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC addr… |
CVE-2022-22268 | Medium | 6.1 | 2022-01-10 | Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX… |
CVE-2022-22267 | Medium | 4.0 | 2022-01-10 | Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information. |
CVE-2020-9061 | Medium | 6.5 | 2022-01-10 | Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon… |
CVE-2021-3837 | Medium | 6.1 | 2022-01-03 | openwhyd is vulnerable to Improper Authorization |
CVE-2021-43847 | Medium | 6.5 | 2021-12-20 | HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauth… |
CVE-2021-25521 | Medium | 4.0 | 2021-12-08 | Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet. |
CVE-2021-42126 | High | 8.8 | 2021-12-07 | An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privi… |
CVE-2021-36311 | Medium | 6.0 | 2021-11-23 | Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privileges may exploit… |
CVE-2021-42338 | Critical | 9.8 | 2021-11-19 | 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in… |
CVE-2021-42337 | Medium | 4.3 | 2021-11-16 | The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker ca… |
CVE-2021-25507 | Medium | 5.7 | 2021-11-05 | Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to acce… |
CVE-2021-25973 | Medium | 6.5 | 2021-11-02 | In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happen… |
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-41313 | Medium | 4.3 | 2021-11-01 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Imprope… |
CVE-2021-41308 | Medium | 6.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via… |
CVE-2021-31384 | High | 7.2 | 2021-10-19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Ne… |
CVE-2021-38486 | High | 8.0 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements… |
CVE-2021-42336 | Medium | 4.3 | 2021-10-15 | The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and… |
CVE-2021-42332 | Medium | 4.3 | 2021-10-15 | The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the… |
CVE-2021-42331 | Medium | 5.4 | 2021-10-15 | The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can acces… |
CVE-2021-42330 | High | 8.8 | 2021-10-15 | The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can acce… |
CVE-2021-41137 | High | 8.8 | 2021-10-13 | Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves b… |
CVE-2021-33723 | Medium | 6.5 | 2021-10-12 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user withou… |
CVE-2021-39317 | High | 8.8 | 2021-10-11 | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX… |
CVE-2021-41976 | Medium | 5.3 | 2021-10-08 | Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book li… |
CVE-2021-41975 | High | 7.5 | 2021-10-08 | TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system witho… |
CVE-2021-41974 | Critical | 9.1 | 2021-10-08 | Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books wi… |
CVE-2021-41568 | Medium | 5.3 | 2021-10-08 | Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and… |
CVE-2021-41564 | Medium | 5.3 | 2021-10-08 | Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily wit… |
CVE-2021-25499 | High | 7.1 | 2021-10-06 | Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Gal… |
CVE-2021-41100 | High | 7.4 | 2021-10-04 | Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of… |
CVE-2021-41093 | High | 7.4 | 2021-10-04 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing t… |
CVE-2021-25460 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService. |
CVE-2021-25459 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService. |
CVE-2021-3049 | Low | 2.6 | 2021-09-08 | An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read p… |
CVE-2021-28567 | Medium | 6.5 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the custom… |
CVE-2021-36037 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-36029 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2021-27663 | High | 8.2 | 2021-08-30 | A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authoriz… |
CVE-2021-28626 | Low | 3.7 | 2021-08-24 | Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users… |
CVE-2021-3616 | Critical | 9.4 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content an… |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-36276 | High | 8.8 | 2021-08-09 | Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of s… |
CVE-2021-35964 | High | 7.3 | 2021-07-19 | The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management f… |
CVE-2021-32688 | High | 8.8 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tok… |
CVE-2021-1576 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-1574 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-25433 | Medium | 5.5 | 2021-07-08 | Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory r… |
CVE-2021-32523 | Critical | 9.1 | 2021-07-07 | Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Sugges… |
CVE-2021-28563 | Medium | 6.5 | 2021-06-28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create… |
CVE-2021-3044 | Critical | 9.8 | 2021-06-22 | An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR se… |
CVE-2021-23140 | Critical | 9.9 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator. T… |
CVE-2021-23136 | Medium | 6.5 | 2021-06-11 | Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an unprivileged Command Centre Operator. This… |
CVE-2021-25417 | High | 7.5 | 2021-06-11 | Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage. |
CVE-2021-25399 | High | 7.1 | 2021-06-11 | Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. |
CVE-2020-25716 | High | 8.1 | 2021-06-07 | A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific… |
CVE-2020-1690 | Medium | 6.5 | 2021-06-07 | An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege esc… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-32619 | Critical | 9.8 | 2021-05-28 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported thro… |
CVE-2020-10716 | Medium | 6.5 | 2021-05-27 | A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Sate… |
CVE-2021-24195 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin befor… |
CVE-2021-24194 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin b… |
CVE-2021-24193 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12… |
CVE-2021-24192 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (… |
CVE-2021-24191 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin be… |
CVE-2021-24190 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before… |
CVE-2021-24189 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugi… |
CVE-2021-24188 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin befo… |
CVE-2021-28799 | Critical | 10.0 | 2021-05-13 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote… |
CVE-2020-17517 | High | 7.5 | 2021-04-27 | The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access… |
CVE-2021-25382 | Medium | 6.1 | 2021-04-23 | An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents in Secure Folder v… |
CVE-2021-0260 | High | 7.3 | 2021-04-22 | An improper authorization vulnerability in the Simple Network Management Protocol daemon (snmpd) service of Juniper Networks Junos OS leads an unauthenticated… |
CVE-2021-21096 | Medium | 5.5 | 2021-04-15 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Improper Authorization vulnerability in the Genuine Software Service. A… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |
CVE-2021-25374 | High | 8.6 | 2021-04-09 | An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9… |
CVE-2021-25373 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2… |
CVE-2021-21432 | High | 7.5 | 2021-04-09 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enabl… |
CVE-2021-22865 | Medium | 6.5 | 2021-04-02 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication… |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-25354 | Low | 3.3 | 2021-03-25 | Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink. |
CVE-2021-25353 | Medium | 5.5 | 2021-03-25 | Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes applicat… |
CVE-2021-25352 | Medium | 5.5 | 2021-03-25 | Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the… |
CVE-2021-25351 | Low | 3.2 | 2021-03-25 | Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user… |
CVE-2019-14828 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to cre… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2020-27779 | High | 7.5 | 2021-03-03 | A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ra… |
CVE-2021-22863 | High | 8.1 | 2021-03-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify… |
CVE-2021-22862 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to… |
CVE-2021-22861 | Medium | 6.5 | 2021-03-03 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to un… |