CWE-863 · Incorrect Authorization (page 29)
Page 29 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-24770 | Medium | 6.5 | 2021-11-01 | The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users… |
CVE-2021-24757 | Medium | 5.3 | 2021-11-01 | The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticate… |
CVE-2021-24742 | Medium | 6.5 | 2021-11-01 | The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it us… |
CVE-2021-24717 | High | 8.8 | 2021-11-01 | The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose ti… |
CVE-2021-41189 | High | 7.2 | 2021-10-29 | DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become s… |
CVE-2021-39321 | High | 8.8 | 2021-10-21 | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to de… |
CVE-2021-38345 | High | 7.1 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-ad… |
CVE-2021-20803 | Medium | 5.4 | 2021-10-13 | Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the m… |
CVE-2021-40456 | Medium | 5.3 | 2021-10-13 | Windows AD FS Security Feature Bypass Vulnerability |
CVE-2021-42137 | Medium | 5.3 | 2021-10-11 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that sh… |
CVE-2021-28661 | Medium | 4.3 | 2021-10-07 | Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass. |
CVE-2021-22262 | Medium | 5.4 | 2021-10-05 | Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from… |
CVE-2021-41093 | High | 7.4 | 2021-10-04 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing t… |
CVE-2021-22535 | Medium | 4.9 | 2021-09-28 | Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior… |
CVE-2021-24652 | Medium | 6.5 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax bas… |
CVE-2021-40655 | High | 7.5 | 2021-09-24 | An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request… |
CVE-2021-40654 | Medium | 6.5 | 2021-09-24 | An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.ph… |
CVE-2021-36749 | Medium | 6.5 | 2021-09-24 | In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2020-19551 | High | 8.8 | 2021-09-21 | Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong. |
CVE-2021-41082 | High | 7.5 | 2021-09-20 | Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed t… |
CVE-2020-16630 | Medium | 6.8 | 2021-09-20 | TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an… |
CVE-2019-16651 | Medium | 5.3 | 2021-09-20 | An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is… |
CVE-2021-40639 | High | 7.5 | 2021-09-15 | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
CVE-2020-21124 | Critical | 9.8 | 2021-09-15 | UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page. |
CVE-2021-39206 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 an… |
CVE-2021-28911 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial… |
CVE-2021-22239 | Medium | 5.0 | 2021-09-09 | An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. |
CVE-2021-28567 | Medium | 6.5 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the custom… |
CVE-2021-35526 | Medium | 6.3 | 2021-09-08 | Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive infor… |
CVE-2021-1854 | Medium | 4.3 | 2021-09-08 | A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically a… |
CVE-2020-19765 | High | 7.5 | 2021-09-07 | An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack. |
CVE-2021-35949 | Medium | 5.3 | 2021-09-07 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about… |
CVE-2021-38312 | High | 7.1 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered unde… |
CVE-2021-39119 | Medium | 5.3 | 2021-09-01 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Ji… |
CVE-2021-36039 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via th… |
CVE-2021-39164 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list… |
CVE-2021-39163 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, to… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2021-28696 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-22256 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status |
CVE-2021-22247 | Medium | 4.3 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics |
CVE-2021-22243 | Medium | 5.0 | 2021-08-25 | Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain… |
CVE-2021-22236 | Medium | 5.5 | 2021-08-25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present… |
CVE-2021-39156 | High | 8.1 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-39155 | High | 8.3 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-32779 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled… |
CVE-2021-32777 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension… |
CVE-2021-30987 | Medium | 5.5 | 2021-08-24 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked via BSSIDs. |
CVE-2021-30975 | High | 8.6 | 2021-08-24 | This issue was addressed by disabling execution of JavaScript when viewing a scripting dictionary. This issue is fixed in macOS Monterey 12.1, Security Update… |
CVE-2021-30972 | Medium | 5.5 | 2021-08-24 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-001 Catalina, macOS Big Sur 11.6.3. A malicious application may be a… |
CVE-2021-30925 | Critical | 9.1 | 2021-08-24 | The issue was addressed with improved permissions logic. This issue is fixed in watchOS 8, macOS Big Sur 11.6, iOS 15 and iPadOS 15. A malicious application ma… |
CVE-2021-30856 | Critical | 9.1 | 2021-08-24 | This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions. This issue is fixed in macOS Big Sur 1… |
CVE-2021-26040 | Critical | 9.1 | 2021-08-24 | An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. |
CVE-2021-22253 | Medium | 4.9 | 2021-08-23 | Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protecte… |
CVE-2021-22251 | Medium | 4.3 | 2021-08-23 | Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain th… |
CVE-2021-37598 | Medium | 5.3 | 2021-08-19 | WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character. |
CVE-2021-39138 | Medium | 4.8 | 2021-08-19 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and als… |
CVE-2021-0645 | High | 7.8 | 2021-08-17 | In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an a… |
CVE-2021-32829 | Critical | 9.6 | 2021-08-17 | ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by… |
CVE-2020-18701 | Critical | 9.8 | 2021-08-16 | Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not inva… |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-27793 | Medium | 5.3 | 2021-08-12 | ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS be… |
CVE-2020-25564 | High | 8.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSa… |
CVE-2020-28397 | Medium | 5.3 | 2021-08-10 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS v… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2021-38137 | High | 8.1 | 2021-08-06 | Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to perform actions not b… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2021-33335 | High | 7.2 | 2021-08-03 | Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authe… |
CVE-2020-19301 | Critical | 9.8 | 2021-08-03 | A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition param… |
CVE-2021-30571 | Critical | 9.6 | 2021-08-03 | Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2021-22398 | Medium | 4.6 | 2021-08-02 | There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on… |
CVE-2021-22389 | Critical | 9.8 | 2021-08-02 | There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed. |
CVE-2021-22521 | Medium | 6.7 | 2021-07-30 | A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versi… |
CVE-2021-28674 | Medium | 5.4 | 2021-07-30 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) v… |
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-36230 | High | 8.8 | 2021-07-20 | HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token… |
CVE-2021-36758 | Medium | 5.4 | 2021-07-16 | 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privi… |
CVE-2020-12733 | High | 7.5 | 2021-07-15 | Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the molinkadmin passwo… |
CVE-2021-33718 | Medium | 5.3 | 2021-07-13 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7… |
CVE-2021-22515 | Medium | 4.8 | 2021-07-12 | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions pri… |
CVE-2021-26273 | High | 7.8 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Incorrect Access Control. |
CVE-2021-24405 | Medium | 6.5 | 2021-07-06 | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (suc… |
CVE-2021-36132 | High | 8.8 | 2021-07-02 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variabl… |
CVE-2021-35197 | High | 7.5 | 2021-07-02 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "… |
CVE-2020-27362 | High | 8.8 | 2021-07-01 | An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file e… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-29961 | Medium | 4.3 | 2021-06-24 | When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface… |
CVE-2021-29959 | Medium | 4.3 | 2021-06-24 | When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it wit… |
CVE-2021-32701 | High | 7.5 | 2021-06-22 | ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a… |
CVE-2010-2525 | High | 7.8 | 2021-06-22 | A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or e… |
CVE-2021-0571 | High | 7.8 | 2021-06-22 | In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access… |
CVE-2010-1435 | Critical | 9.8 | 2021-06-21 | Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently re… |
CVE-2021-24379 | Medium | 5.3 | 2021-06-21 | The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX req… |
CVE-2020-20471 | High | 8.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate t… |
CVE-2020-20466 | Critical | 9.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user. |