CWE-863 · Incorrect Authorization (page 30)
Page 30 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26845 | High | 7.5 | 2021-06-14 | Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report… |
CVE-2021-0472 | High | 7.8 | 2021-06-11 | In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to loc… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-25410 | High | 7.1 | 2021-06-11 | Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated pri… |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-21664 | Medium | 6.5 | 2021-06-10 | An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacke… |
CVE-2021-30539 | Medium | 5.4 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30538 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30537 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. |
CVE-2021-30534 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2021-30533 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2021-33881 | Medium | 4.2 | 2021-06-06 | On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter… |
CVE-2021-1540 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-1539 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-3469 | Medium | 5.4 | 2021-06-03 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-pr… |
CVE-2021-3499 | Medium | 5.6 | 2021-06-02 | A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there i… |
CVE-2021-20306 | Medium | 4.3 | 2021-06-01 | A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projec… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-32619 | Critical | 9.8 | 2021-05-28 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported thro… |
CVE-2021-29628 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a… |
CVE-2020-1729 | Medium | 4.4 | 2021-05-28 | A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoa… |
CVE-2020-26560 | High | 8.1 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner… |
CVE-2020-26559 | High | 8.8 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the… |
CVE-2020-26555 | Medium | 5.4 | 2021-05-24 | Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of t… |
CVE-2021-21552 | Medium | 5.2 | 2021-05-21 | Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability. A local authenticated malicious user wi… |
CVE-2021-31158 | Medium | 6.5 | 2021-05-19 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allo… |
CVE-2021-20429 | Medium | 5.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 19633… |
CVE-2021-24282 | Medium | 6.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pl… |
CVE-2021-24281 | Medium | 4.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action… |
CVE-2021-24279 | Medium | 6.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to insta… |
CVE-2021-24278 | High | 7.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce f… |
CVE-2021-31876 | Medium | 6.5 | 2021-05-13 | Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a los… |
CVE-2021-3457 | Medium | 6.1 | 2021-05-12 | An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should b… |
CVE-2020-36289 | Medium | 5.3 | 2021-05-12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… |
CVE-2021-31165 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-20538 | Critical | 9.1 | 2021-05-10 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due… |
CVE-2021-23015 | High | 7.2 | 2021-05-10 | On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated… |
CVE-2021-31829 | Medium | 5.5 | 2021-05-06 | kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attack… |
CVE-2021-22209 | High | 7.5 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted… |
CVE-2021-24244 | Medium | 6.5 | 2021-05-06 | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low p… |
CVE-2021-22211 | Low | 3.1 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a… |
CVE-2021-21228 | Medium | 4.3 | 2021-04-30 | Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2021-31926 | Medium | 6.5 | 2021-04-30 | AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by cra… |
CVE-2021-1086 | High | 7.1 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead t… |
CVE-2020-21990 | High | 7.5 | 2021-04-29 | Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access contro… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2021-29158 | Medium | 4.9 | 2021-04-23 | Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. |
CVE-2021-31554 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created Media… |
CVE-2021-31552 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after acc… |
CVE-2021-31548 | Medium | 6.5 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked coul… |
CVE-2021-28793 | Critical | 9.8 | 2021-04-20 | vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via… |
CVE-2021-3493 | High | 8.8 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an unde… |
CVE-2021-29452 | High | 8.1 | 2021-04-16 | a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This fea… |
CVE-2021-28826 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging -… |
CVE-2021-28825 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - E… |
CVE-2021-29439 | High | 7.2 | 2021-04-13 | The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can ins… |
CVE-2021-29437 | High | 8.0 | 2021-04-13 | ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a… |
CVE-2021-27086 | High | 7.8 | 2021-04-13 | Windows Services and Controller App Elevation of Privilege Vulnerability |
CVE-2021-29943 | Critical | 9.1 | 2021-04-13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server… |
CVE-2019-15059 | High | 7.5 | 2021-04-12 | In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar with… |
CVE-2020-28872 | Critical | 9.8 | 2021-04-12 | An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid c… |
CVE-2021-25356 | High | 7.1 | 2021-04-09 | An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application… |
CVE-2020-36287 | Medium | 5.3 | 2021-04-09 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14… |
CVE-2020-14106 | Medium | 5.5 | 2021-04-08 | The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26. |
CVE-2021-24207 | Medium | 4.3 | 2021-04-05 | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles mu… |
CVE-2020-27901 | Medium | 6.3 | 2021-04-02 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007… |
CVE-2021-26718 | Medium | 5.5 | 2021-04-01 | KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. |
CVE-2020-36238 | Medium | 5.3 | 2021-04-01 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 befor… |
CVE-2021-29642 | Medium | 5.3 | 2021-03-30 | GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. |
CVE-2021-28936 | High | 7.5 | 2021-03-29 | The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. T… |
CVE-2021-21411 | Medium | 5.5 | 2021-03-26 | OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based aut… |
CVE-2021-21389 | High | 8.1 | 2021-03-26 | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged… |
CVE-2021-27195 | Medium | 5.9 | 2021-03-25 | Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic. |
CVE-2021-22186 | Medium | 4.9 | 2021-03-24 | An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners |
CVE-2021-22176 | Medium | 4.3 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on… |
CVE-2021-28824 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpa… |
CVE-2021-28823 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition… |
CVE-2021-28821 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO E… |
CVE-2021-28819 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition co… |
CVE-2021-28146 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication se… |
CVE-2021-28791 | High | 7.8 | 2021-03-18 | The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspac… |
CVE-2021-21624 | Medium | 4.3 | 2021-03-18 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to… |
CVE-2021-21623 | Medium | 6.5 | 2021-03-18 | An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to a… |
CVE-2021-28681 | Medium | 5.3 | 2021-03-18 | Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a… |
CVE-2021-20676 | Medium | 4.3 | 2021-03-18 | M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D)… |
CVE-2020-24264 | Critical | 9.8 | 2021-03-16 | Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts a… |
CVE-2021-20283 | Medium | 4.3 | 2021-03-15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in eac… |
CVE-2021-20282 | Medium | 5.3 | 2021-03-15 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5… |
CVE-2021-20281 | Medium | 5.3 | 2021-03-15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3… |
CVE-2020-25240 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An at… |
CVE-2020-25239 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for… |
CVE-2021-20179 | High | 8.1 | 2021-03-15 | A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again… |
CVE-2021-28373 | High | 7.5 | 2021-03-13 | The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this iss… |
CVE-2020-35682 | High | 8.8 | 2021-03-13 | Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login). |
CVE-2021-21367 | Medium | 6.1 | 2021-03-12 | Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetoo… |
CVE-2021-0382 | Medium | 5.5 | 2021-03-10 | In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local infor… |
CVE-2021-0376 | High | 7.8 | 2021-03-10 | In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lea… |
CVE-2021-21186 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by… |
CVE-2021-21182 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2021-21484 | Critical | 9.8 | 2021-03-09 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. |