CWE-863 · Incorrect Authorization (page 28)
Page 28 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0482 | Critical | 9.1 | 2022-03-09 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. |
CVE-2022-24714 | Medium | 5.3 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affect… |
CVE-2021-41241 | Medium | 4.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a gr… |
CVE-2021-24824 | Medium | 4.3 | 2022-03-07 | The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, t… |
CVE-2021-3658 | Medium | 6.5 | 2022-03-02 | bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered do… |
CVE-2022-24306 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. |
CVE-2022-0829 | High | 8.1 | 2022-03-02 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-0824 | High | 8.8 | 2022-03-02 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2022-0762 | Medium | 5.5 | 2022-02-26 | Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-21706 | High | 7.2 | 2022-02-26 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control… |
CVE-2019-25058 | High | 7.8 | 2022-02-24 | An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devi… |
CVE-2022-0727 | Medium | 5.4 | 2022-02-23 | Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-25335 | High | 7.5 | 2022-02-18 | RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in Februa… |
CVE-2022-21141 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2020-25722 | High | 8.8 | 2022-02-18 | Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total dom… |
CVE-2022-0451 | Medium | 6.5 | 2022-02-18 | Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly… |
CVE-2022-25318 | Medium | 4.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups. |
CVE-2022-0633 | Medium | 6.5 | 2022-02-17 | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's… |
CVE-2022-25270 | Medium | 6.5 | 2022-02-17 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission vie… |
CVE-2021-3560 | High | 7.8 | 2022-02-16 | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user… |
CVE-2021-22042 | High | 7.8 | 2022-02-16 | VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within… |
CVE-2022-0580 | High | 7.1 | 2022-02-14 | Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0309 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2022-0117 | Medium | 6.5 | 2022-02-12 | Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-23998 | Medium | 6.2 | 2022-02-11 | Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows… |
CVE-2020-13676 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affe… |
CVE-2021-39943 | Medium | 4.3 | 2022-02-09 | An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from… |
CVE-2022-23615 | Medium | 5.4 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can sa… |
CVE-2022-23627 | Medium | 5.0 | 2022-02-08 | ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced… |
CVE-2022-21713 | Medium | 4.3 | 2022-02-08 | Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle us… |
CVE-2021-24947 | Medium | 6.5 | 2022-02-07 | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_i… |
CVE-2021-29394 | Medium | 6.5 | 2022-02-04 | Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to chang… |
CVE-2022-24307 | Critical | 9.8 | 2022-02-03 | Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has… |
CVE-2021-41571 | Medium | 6.5 | 2022-02-01 | In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-messa… |
CVE-2021-25097 | Medium | 6.5 | 2022-02-01 | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated use… |
CVE-2022-0273 | Medium | 6.5 | 2022-01-30 | Improper Access Control in Pypi calibreweb prior to 0.6.16. |
CVE-2021-46561 | High | 7.2 | 2022-01-26 | controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrato… |
CVE-2022-23009 | High | 7.2 | 2022-01-25 | On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices… |
CVE-2022-0334 | Medium | 4.3 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lea… |
CVE-2022-0333 | Low | 3.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability al… |
CVE-2021-4133 | High | 8.8 | 2022-01-25 | A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accou… |
CVE-2021-24733 | Medium | 4.3 | 2022-01-24 | The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected p… |
CVE-2022-21707 | Medium | 6.3 | 2022-01-21 | wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior… |
CVE-2020-4877 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 19… |
CVE-2022-21701 | Medium | 5.0 | 2022-01-19 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Use… |
CVE-2022-22167 | High | 7.2 | 2022-01-19 | A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Ins… |
CVE-2022-22157 | High | 7.2 | 2022-01-19 | A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Ins… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2020-14110 | High | 7.8 | 2022-01-18 | AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background. |
CVE-2021-39630 | High | 7.8 | 2022-01-14 | In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could… |
CVE-2022-21678 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and ver… |
CVE-2022-21894 | Medium | 4.4 | 2022-01-11 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-45457 | High | 7.5 | 2022-01-06 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versi… |
CVE-2021-20868 | Medium | 4.5 | 2022-01-04 | Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and earlier, bizhub C36… |
CVE-2021-20149 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to… |
CVE-2021-43858 | High | 8.8 | 2021-12-27 | MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call… |
CVE-2021-45339 | High | 7.8 | 2021-12-27 | Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could… |
CVE-2021-23175 | High | 8.2 | 2021-12-23 | NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users o… |
CVE-2021-38017 | High | 8.8 | 2021-12-23 | Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2021-38016 | High | 8.8 | 2021-12-23 | Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2021-23803 | Critical | 9.8 | 2021-12-17 | This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template… |
CVE-2021-45102 | High | 8.8 | 2021-12-16 | An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon using a SciToken, a user may be grante… |
CVE-2021-0649 | High | 7.8 | 2021-12-15 | In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWA… |
CVE-2021-39945 | Low | 2.7 | 2021-12-13 | Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all vers… |
CVE-2021-39936 | Low | 3.5 | 2021-12-13 | Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions st… |
CVE-2021-39930 | Medium | 4.3 | 2021-12-13 | Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a u… |
CVE-2021-39918 | Low | 3.1 | 2021-12-13 | Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions start… |
CVE-2021-24872 | Medium | 6.5 | 2021-12-13 | The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the pe… |
CVE-2021-24819 | Medium | 4.3 | 2021-12-13 | The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to a… |
CVE-2021-41805 | High | 8.8 | 2021-12-12 | HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator… |
CVE-2021-29678 | High | 8.7 | 2021-12-09 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other datab… |
CVE-2021-38503 | Critical | 10.0 | 2021-12-08 | The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the… |
CVE-2021-41013 | Medium | 5.3 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may a… |
CVE-2021-42758 | High | 8.8 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute an… |
CVE-2021-43781 | Medium | 6.4 | 2021-12-06 | Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versi… |
CVE-2021-24917 | High | 7.5 | 2021-12-06 | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to… |
CVE-2021-4026 | Medium | 4.3 | 2021-11-30 | bookstack is vulnerable to Improper Access Control |
CVE-2021-24842 | Medium | 5.4 | 2021-11-29 | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titl… |
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-22966 | High | 8.8 | 2021-11-19 | Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate pag… |
CVE-2021-39234 | Medium | 6.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypas… |
CVE-2021-43553 | Low | 3.1 | 2021-11-17 | PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a L… |
CVE-2021-24851 | Medium | 4.3 | 2021-11-17 | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardl… |
CVE-2021-41244 | Critical | 9.1 | 2021-11-15 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and ther… |
CVE-2021-3577 | High | 8.8 | 2021-11-12 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same n… |
CVE-2021-1903 | Medium | 5.3 | 2021-11-12 | Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon Aut… |
CVE-2021-40504 | Medium | 4.9 | 2021-11-10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 7… |
CVE-2021-20119 | High | 7.1 | 2021-11-09 | The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. |
CVE-2021-42026 | Medium | 4.3 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-42025 | Medium | 6.5 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-24788 | Medium | 6.5 | 2021-11-08 | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any a… |
CVE-2021-24783 | Medium | 6.5 | 2021-11-08 | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to… |
CVE-2021-22051 | Medium | 6.5 | 2021-11-08 | Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affec… |
CVE-2021-41230 | Medium | 5.3 | 2021-11-05 | Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in poli… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-39904 | Medium | 4.3 | 2021-11-05 | An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 b… |
CVE-2021-39902 | Medium | 4.3 | 2021-11-04 | Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. |
CVE-2021-21693 | Critical | 9.8 | 2021-11-04 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2… |