CWE-862 · Missing Authorization (page 91)
Page 91 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19754 | High | 8.8 | 2018-12-05 | Tarantella Enterprise before 3.11 allows bypassing Access Control. |
CVE-2018-18647 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization. |
CVE-2018-9457 | Medium | 5.5 | 2018-11-14 | In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass. This could lead to… |
CVE-2018-1314 | Medium | 4.3 | 2018-11-08 | In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized u… |
CVE-2018-19110 | Medium | 6.5 | 2018-11-08 | The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/ski… |
CVE-2018-19079 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SystemReboot metho… |
CVE-2018-15327 | High | 7.2 | 2018-10-31 | In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User I… |
CVE-2018-11785 | Medium | 6.5 | 2018-10-24 | Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, lea… |
CVE-2017-18312 | High | 7.8 | 2018-10-23 | While accessing SafeSwitch services, third party can manipulate a given device and perform unauthorized operation due to lack of checking of same state transit… |
CVE-2018-18377 | High | 7.5 | 2018-10-16 | goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default… |
CVE-2018-15429 | Medium | 5.3 | 2018-10-05 | A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive informatio… |
CVE-2018-16048 | Medium | 6.5 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorizatio… |
CVE-2018-2461 | High | 8.8 | 2018-09-11 | Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalation of privileges. |
CVE-2018-2455 | High | 8.8 | 2018-09-11 | SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA) does not perform necessary authorizat… |
CVE-2018-2454 | High | 8.8 | 2018-09-11 | SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization… |
CVE-2018-16591 | Critical | 9.8 | 2018-09-10 | FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the p… |
CVE-2018-7792 | High | 7.5 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-8028 | High | 8.8 | 2018-08-23 | An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthoriz… |
CVE-2017-2662 | Medium | 4.3 | 2018-08-22 | A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on th… |
CVE-2018-5547 | High | 7.8 | 2018-08-17 | Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to… |
CVE-2017-17707 | High | 8.1 | 2018-07-31 | Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server… |
CVE-2017-2652 | High | 8.8 | 2018-07-27 | It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork C… |
CVE-2017-7530 | High | 8.8 | 2018-07-26 | In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via fi… |
CVE-2018-1116 | Medium | 4.4 | 2018-07-10 | A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows… |
CVE-2018-2436 | High | 8.8 | 2018-07-10 | Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, resulting in escalati… |
CVE-2018-11541 | Critical | 9.8 | 2018-07-09 | A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an… |
CVE-2018-8755 | Critical | 9.8 | 2018-06-25 | NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. By downloading this file, an attacker can acces… |
CVE-2011-4183 | Medium | 6.5 | 2018-06-13 | A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16. |
CVE-2018-5135 | High | 7.5 | 2018-06-11 | WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not b… |
CVE-2018-5113 | High | 7.5 | 2018-06-11 | The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced… |
CVE-2013-3703 | High | 8.8 | 2018-06-08 | The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove us… |
CVE-2018-0336 | High | 8.8 | 2018-06-07 | A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privilege… |
CVE-2018-7689 | High | 7.1 | 2018-06-07 | Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages whe… |
CVE-2018-7688 | High | 7.1 | 2018-06-07 | A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects whe… |
CVE-2018-0322 | High | 8.8 | 2018-06-07 | A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modify sensiti… |
CVE-2018-0317 | High | 8.8 | 2018-06-07 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges… |
CVE-2018-10092 | High | 8.0 | 2018-05-22 | The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command an… |
CVE-2018-8012 | High | 7.5 | 2018-05-21 | No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a… |
CVE-2018-2419 | Low | 3.7 | 2018-05-09 | SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary autho… |
CVE-2018-10251 | Critical | 9.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2018-10207 | Medium | 5.3 | 2018-04-25 | An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and expo… |
CVE-2018-2413 | Medium | 5.4 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2017-18101 | Medium | 6.5 | 2018-04-10 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version… |
CVE-2018-1217 | Critical | 9.8 | 2018-04-09 | Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a… |
CVE-2018-9039 | Medium | 6.5 | 2018-03-27 | In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their… |
CVE-2018-7702 | Critical | 9.1 | 2018-03-15 | SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients… |
CVE-2018-0015 | Critical | 9.8 | 2018-02-22 | A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system comm… |
CVE-2018-2381 | High | 8.8 | 2018-02-14 | SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does no… |
CVE-2017-13247 | High | 7.8 | 2018-02-12 | In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead to local elevation of privileges with us… |
CVE-2018-1000022 | Medium | 5.3 | 2018-02-09 | Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can… |
CVE-2017-18035 | Medium | 4.3 | 2018-02-02 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permis… |
CVE-2017-9513 | Medium | 5.4 | 2018-01-29 | Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & re… |
CVE-2017-1000400 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included… |
CVE-2017-1000390 | Medium | 4.3 | 2018-01-26 | Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the b… |
CVE-2017-1000388 | Medium | 4.3 | 2018-01-26 | Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing any… |
CVE-2018-1000015 | Medium | 4.8 | 2018-01-23 | On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did… |
CVE-2018-6000 | Critical | 9.8 | 2018-01-22 | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for s… |
CVE-2018-0092 | High | 7.1 | 2018-01-18 | A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly del… |
CVE-2017-13209 | High | 7.8 | 2018-01-12 | In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller which could allow an… |
CVE-2018-5377 | Critical | 9.8 | 2018-01-12 | Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter. |
CVE-2017-17807 | Low | 3.3 | 2017-12-20 | The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via… |
CVE-2017-17693 | Medium | 4.3 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback. |
CVE-2017-17665 | High | 8.8 | 2017-12-13 | In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass bec… |
CVE-2017-17450 | High | 7.8 | 2017-12-07 | net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which… |
CVE-2017-17448 | High | 7.8 | 2017-12-07 | net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which all… |
CVE-2017-17433 | Low | 3.7 | 2017-12-06 | The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before… |
CVE-2017-11042 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not… |
CVE-2017-12084 | High | 8.0 | 2017-11-07 | A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely st… |
CVE-2017-1000243 | Medium | 4.3 | 2017-11-01 | Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites |
CVE-2017-1000105 | Medium | 5.3 | 2017-10-05 | The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to arc… |
CVE-2017-1000086 | High | 8.0 | 2017-10-05 | The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore b… |
CVE-2017-10846 | High | 7.5 | 2017-09-15 | Wi-Fi STATION L-02F Software version V10b and earlier allows remote attackers to bypass access restrictions to obtain information on device settings via unspec… |
CVE-2017-1002151 | High | 7.5 | 2017-09-14 | Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization |
CVE-2017-1002007 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into t… |
CVE-2017-1002006 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts int… |
CVE-2017-12582 | Critical | 9.8 | 2017-08-18 | Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user c… |
CVE-2017-7548 | High | 7.5 | 2017-08-16 | PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large o… |
CVE-2017-11135 | High | 7.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism doe… |
CVE-2017-6251 | High | 7.8 | 2017-07-28 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler where a missing permissions check may allow users to gain access to… |
CVE-2017-1000056 | Critical | 9.8 | 2017-07-17 | Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any ex… |
CVE-2017-4985 | High | 7.8 | 2017-06-19 | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their… |
CVE-2017-7914 | High | 8.6 | 2017-06-14 | A Missing Authorization issue was discovered in Rockwell Automation PanelView Plus 6 700-1500 6.00.04, 6.00.05, 6.00.42, 6.00-20140306, 6.10.20121012, 6.10-201… |
CVE-2017-7677 | Medium | 5.9 | 2017-06-14 | In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table. |
CVE-2017-6693 | Medium | 5.5 | 2017-06-13 | A vulnerability in the ConfD server component of Cisco Elastic Services Controllers could allow an authenticated, local attacker to access information stored i… |
CVE-2017-6639 | Critical | 9.8 | 2017-06-08 | A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote… |
CVE-2017-8083 | Medium | 6.7 | 2017-06-06 | CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions… |
CVE-2017-0896 | Medium | 6.5 | 2017-06-02 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that al… |
CVE-2017-9232 | Critical | 9.8 | 2017-05-28 | Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalatio… |
CVE-2017-9036 | High | 7.8 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory. |
CVE-2017-6635 | Medium | 6.5 | 2017-05-22 | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker t… |
CVE-2017-6622 | Critical | 9.8 | 2017-05-18 | A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and pe… |
CVE-2017-6565 | High | 8.8 | 2017-05-01 | On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload file… |
CVE-2017-6564 | Medium | 6.5 | 2017-05-01 | On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter fou… |
CVE-2017-8217 | Medium | 5.3 | 2017-04-25 | TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any int… |
CVE-2017-7622 | High | 8.8 | 2017-04-10 | dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user w… |
CVE-2017-0554 | High | 7.8 | 2017-04-07 | An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to access capabilities outside of its permission… |
CVE-2017-6598 | Medium | 6.7 | 2017-04-07 | A vulnerability in the debug plug-in functionality of the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (N… |
CVE-2017-6369 | High | 8.8 | 2017-03-24 | Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'sys… |
CVE-2017-5930 | Low | 2.7 | 2017-03-20 | The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delet… |