CWE-285 · Improper Authorization (page 18)
Page 18 of 18 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12160 | High | 7.2 | 2017-10-26 | It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indef… |
CVE-2017-1002151 | High | 7.5 | 2017-09-14 | Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization |
CVE-2015-3656 | High | 7.2 | 2017-08-29 | Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by levera… |
CVE-2017-6044 | Critical | 9.8 | 2017-06-30 | An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4… |
CVE-2016-1000219 | High | 7.5 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This inf… |
CVE-2014-9950 | High | 7.8 | 2017-06-06 | In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. |
CVE-2014-9945 | High | 7.8 | 2017-06-06 | In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. |
CVE-2017-0896 | Medium | 6.5 | 2017-06-02 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that al… |
CVE-2017-7484 | High | 7.5 | 2017-05-12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x be… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-0894 | Medium | 4.3 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potenti… |
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2016-5063 | Medium | 5.3 | 2017-05-02 | The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks an… |
CVE-2016-8776 | Medium | 4.6 | 2017-04-02 | Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the facto… |
CVE-2017-2689 | High | 8.8 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged fi… |
CVE-2017-2686 | Medium | 6.5 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port… |
CVE-2016-9464 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does… |
CVE-2016-7651 | Medium | 5.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. watchOS before 3.1.1 is affected. The issue involves the "Accounts" component… |
CVE-2016-8443 | High | 7.8 | 2017-01-12 | Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.1… |
CVE-2016-9217 | High | 8.8 | 2016-12-26 | A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to… |
CVE-2016-9938 | Medium | 5.3 | 2016-12-12 | An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16… |
CVE-2016-5788 | Critical | 10.0 | 2016-11-25 | General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote a… |
CVE-2016-7097 | Medium | 4.4 | 2016-10-16 | The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privile… |
CVE-2015-1000007 | High | 7.5 | 2016-10-06 | Remote file download vulnerability in wptf-image-gallery v1.03 |
CVE-2016-7143 | High | 8.1 | 2016-09-21 | The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as… |
CVE-2016-0922 | Critical | 9.8 | 2016-09-18 | EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a b… |
CVE-2016-3352 | High | 8.8 | 2016-09-14 | Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for re… |
CVE-2016-6825 | Critical | 9.8 | 2016-09-07 | Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 ser… |
CVE-2016-5676 | High | 7.5 | 2016-08-31 | cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote att… |
CVE-2016-5799 | Critical | 9.8 | 2016-08-24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it e… |
CVE-2016-5420 | High | 7.5 | 2016-08-10 | curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the… |
CVE-2016-4531 | High | 7.3 | 2016-07-28 | Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to… |
CVE-2016-1711 | High | 8.8 | 2016-07-23 | WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation o… |
CVE-2016-1710 | High | 8.8 | 2016-07-23 | The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent wi… |
CVE-2014-2349 | | 2014-05-22 | Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restr… |