CWE-285 · Improper Authorization (page 15)
Page 15 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9325 | High | 7.5 | 2019-07-03 | The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs. |
CVE-2017-8409 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the devi… |
CVE-2018-16086 | Medium | 5.4 | 2019-06-27 | Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2018-16077 | Medium | 6.5 | 2019-06-27 | Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page. |
CVE-2018-16074 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML… |
CVE-2018-16073 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML… |
CVE-2019-10154 | High | 7.5 | 2019-06-26 | A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. |
CVE-2019-1899 | Medium | 5.3 | 2019-06-20 | A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices… |
CVE-2019-1898 | Medium | 5.3 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the… |
CVE-2019-1897 | Medium | 5.3 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to disconnect… |
CVE-2018-13908 | High | 7.8 | 2019-06-14 | Truncated access authentication token leads to weakened access control for stored secure application data in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2017-8252 | Medium | 5.5 | 2019-06-14 | Kernel can inject faults in computations during the execution of TrustZone leading to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-10159 | Medium | 4.3 | 2019-06-14 | cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An… |
CVE-2019-6582 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-6581 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-1842 | Medium | 5.4 | 2019-06-05 | A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in… |
CVE-2017-8777 | High | 7.2 | 2019-05-22 | Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. |
CVE-2019-1851 | Medium | 6.8 | 2019-05-16 | A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generat… |
CVE-2019-1859 | High | 7.2 | 2019-05-03 | A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certif… |
CVE-2019-3842 | High | 7.0 | 2019-04-09 | In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible fo… |
CVE-2015-5463 | Critical | 9.8 | 2019-04-03 | AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) ac… |
CVE-2019-3849 | High | 8.8 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed… |
CVE-2015-3954 | Critical | 9.8 | 2019-03-25 | Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior giv… |
CVE-2019-3785 | High | 8.1 | 2019-03-13 | Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read perm… |
CVE-2019-1604 | High | 7.8 | 2019-03-08 | A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an… |
CVE-2019-1603 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to escalate lower-level privileges to the administrator level… |
CVE-2018-9867 | Medium | 5.5 | 2019-02-19 | In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Admin… |
CVE-2019-3820 | Medium | 4.3 | 2019-02-06 | It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to… |
CVE-2018-14666 | Medium | 6.8 | 2019-01-22 | An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Ha… |
CVE-2018-14662 | Medium | 5.7 | 2019-01-15 | It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryp… |
CVE-2018-15465 | High | 8.1 | 2018-12-24 | A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and… |
CVE-2018-14637 | Medium | 6.1 | 2018-11-30 | The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnera… |
CVE-2018-17933 | High | 8.8 | 2018-10-30 | VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User accounts may be able to execute commands… |
CVE-2016-10734 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. |
CVE-2018-15405 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an… |
CVE-2018-0460 | Medium | 6.5 | 2018-10-05 | A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an af… |
CVE-2018-0459 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to… |
CVE-2018-3829 | Medium | 5.3 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An… |
CVE-2016-7035 | High | 8.8 | 2018-09-10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pa… |
CVE-2016-7078 | Medium | 4.3 | 2018-09-10 | foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/loca… |
CVE-2016-7077 | Medium | 4.3 | 2018-09-10 | foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthoriz… |
CVE-2016-7071 | High | 8.8 | 2018-09-10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated att… |
CVE-2016-0373 | Low | 3.1 | 2018-08-30 | IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing use… |
CVE-2014-6049 | Low | 2.7 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. |
CVE-2018-3778 | Medium | 5.3 | 2018-08-08 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. |
CVE-2018-0391 | Medium | 6.5 | 2018-08-01 | A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to… |
CVE-2018-12467 | Medium | 6.0 | 2018-08-01 | Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage… |
CVE-2018-12466 | Medium | 4.4 | 2018-08-01 | openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. |
CVE-2017-2632 | Medium | 4.9 | 2018-07-27 | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level th… |
CVE-2017-2589 | High | 8.7 | 2018-07-26 | It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally an… |
CVE-2018-10906 | Medium | 5.3 | 2018-07-24 | In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to moun… |
CVE-2018-0393 | Medium | 6.5 | 2018-07-18 | A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy… |
CVE-2018-1116 | Medium | 4.4 | 2018-07-10 | A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows… |
CVE-2018-10861 | High | 8.1 | 2018-07-10 | A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and co… |
CVE-2017-16773 | Medium | 6.5 | 2018-07-05 | Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission… |
CVE-2018-1113 | Medium | 4.8 | 2018-07-03 | setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assu… |
CVE-2017-16726 | Critical | 9.1 | 2018-06-27 | Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve s… |
CVE-2013-7245 | High | 7.5 | 2018-04-24 | The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging f… |
CVE-2018-1082 | High | 8.1 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the use… |
CVE-2017-0927 | Medium | 6.5 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deploy… |
CVE-2017-0926 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. |
CVE-2015-7463 | Medium | 4.3 | 2018-03-15 | IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data… |
CVE-2016-9575 | Medium | 6.3 | 2018-03-13 | Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certp… |
CVE-2017-9268 | Medium | 4.4 | 2018-03-01 | In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause… |
CVE-2017-11398 | High | 8.8 | 2018-01-19 | A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated… |
CVE-2017-16743 | Critical | 9.8 | 2018-01-12 | An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remot… |
CVE-2017-12160 | High | 7.2 | 2017-10-26 | It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indef… |
CVE-2017-1002151 | High | 7.5 | 2017-09-14 | Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization |
CVE-2015-3656 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by levera… |
CVE-2017-6044 | Critical | 9.8 | 2017-06-30 | An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4… |
CVE-2016-1000219 | High | 7.5 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This inf… |
CVE-2014-9950 | High | 7.8 | 2017-06-06 | In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. |
CVE-2014-9945 | High | 7.8 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. |
CVE-2017-0896 | Medium | 6.5 | 2017-06-02 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that al… |
CVE-2017-7484 | High | 7.5 | 2017-05-12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x be… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-0894 | Medium | 4.3 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potenti… |
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2016-5063 | Medium | 5.3 | 2017-05-02 | The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks an… |
CVE-2016-8776 | Medium | 4.6 | 2017-04-02 | Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the facto… |
CVE-2017-2689 | High | 8.8 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged fi… |
CVE-2017-2686 | Medium | 6.5 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port… |
CVE-2016-9464 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does… |
CVE-2016-7651 | Medium | 5.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. watchOS before 3.1.1 is affected. The issue involves the "Accounts" component… |
CVE-2016-8443 | High | 7.8 | 2017-01-12 | Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.1… |
CVE-2016-9217 | High | 8.8 | 2016-12-26 | A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to… |
CVE-2016-9938 | Medium | 5.3 | 2016-12-12 | An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16… |
CVE-2016-5788 | Critical | 10.0 | 2016-11-25 | General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote a… |
CVE-2016-7097 | Medium | 4.4 | 2016-10-16 | The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privile… |
CVE-2015-1000007 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in wptf-image-gallery v1.03 |
CVE-2016-7143 | High | 8.1 | 2016-09-21 | The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as… |
CVE-2016-0922 | Critical | 9.8 | 2016-09-18 | EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a b… |
CVE-2016-3352 | High | 8.8 | 2016-09-14 | Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for re… |
CVE-2016-6825 | Critical | 9.8 | 2016-09-07 | Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 ser… |
CVE-2016-5676 | High | 7.5 | 2016-08-31 | cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote att… |
CVE-2016-5799 | Critical | 9.8 | 2016-08-24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it e… |
CVE-2016-5420 | High | 7.5 | 2016-08-10 | curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the… |
CVE-2016-4531 | High | 7.3 | 2016-07-28 | Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to… |
CVE-2016-1711 | High | 8.8 | 2016-07-23 | WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation o… |
CVE-2016-1710 | High | 8.8 | 2016-07-23 | The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent wi… |