CWE-863 · Incorrect Authorization (page 31)
Page 31 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21481 | High | 8.8 | 2021-03-09 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might all… |
CVE-2021-22134 | Medium | 4.3 | 2021-03-08 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2020-29020 | Critical | 9.1 | 2021-03-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured… |
CVE-2021-27099 | Medium | 6.8 | 2021-03-05 | In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID temp… |
CVE-2021-26964 | High | 7.1 | 2021-03-05 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in… |
CVE-2021-21725 | Medium | 5.7 | 2021-03-05 | A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by pe… |
CVE-2021-26027 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article. |
CVE-2021-27225 | Medium | 5.4 | 2021-03-01 | In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2021-20229 | Medium | 4.3 | 2021-02-23 | A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all c… |
CVE-2021-22113 | Medium | 5.3 | 2021-02-23 | Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Hea… |
CVE-2021-27509 | High | 7.5 | 2021-02-19 | In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. |
CVE-2020-12668 | Medium | 6.5 | 2021-02-19 | Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the appl… |
CVE-2021-21318 | Medium | 5.4 | 2021-02-18 | Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerabil… |
CVE-2021-26753 | Critical | 9.9 | 2021-02-12 | NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This… |
CVE-2021-20188 | High | 7.0 | 2021-02-11 | A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abus… |
CVE-2021-27177 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3… |
CVE-2020-8806 | High | 7.5 | 2021-02-05 | Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected beca… |
CVE-2020-27873 | Medium | 6.5 | 2021-02-04 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authe… |
CVE-2021-25777 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. |
CVE-2021-25774 | Medium | 4.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. |
CVE-2019-25017 | Medium | 5.9 | 2021-02-02 | An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/direct… |
CVE-2021-21286 | High | 7.7 | 2021-02-01 | AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authoriz… |
CVE-2021-21276 | Critical | 9.3 | 2021-02-01 | Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instance… |
CVE-2020-29605 | Medium | 4.3 | 2021-01-29 | An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access… |
CVE-2021-3337 | High | 7.5 | 2021-01-28 | The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quot… |
CVE-2020-1725 | Medium | 5.4 | 2021-01-28 | A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and af… |
CVE-2021-26026 | High | 7.8 | 2021-01-26 | PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a… |
CVE-2021-26025 | High | 7.8 | 2021-01-26 | PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a… |
CVE-2020-9492 | High | 8.8 | 2021-01-26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without… |
CVE-2021-1305 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authori… |
CVE-2021-1270 | Medium | 6.3 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to vie… |
CVE-2021-1269 | Medium | 6.3 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to vie… |
CVE-2020-4873 | Medium | 5.3 | 2021-01-19 | IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836. |
CVE-2021-21013 | High | 8.1 | 2021-01-13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the cu… |
CVE-2021-1144 | High | 8.8 | 2021-01-13 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the passwor… |
CVE-2021-1143 | Medium | 4.3 | 2021-01-13 | A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on t… |
CVE-2021-21609 | Medium | 5.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without O… |
CVE-2021-0319 | High | 7.3 | 2021-01-11 | In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate perm… |
CVE-2021-0317 | High | 7.8 | 2021-01-11 | In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of pri… |
CVE-2018-8724 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr… |
CVE-2018-8044 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K… |
CVE-2021-1054 | Medium | 5.5 | 2021-01-08 | NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the so… |
CVE-2020-35948 | Critical | 9.9 | 2021-01-01 | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary f… |
CVE-2016-20005 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advis… |
CVE-2016-20004 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory p… |
CVE-2016-20002 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2016-20001 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory po… |
CVE-2020-26029 | Medium | 6.5 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks ar… |
CVE-2020-26028 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. |
CVE-2020-24674 | High | 8.8 | 2020-12-22 | In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execu… |
CVE-2020-4794 | Medium | 5.4 | 2020-12-21 | IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could all… |
CVE-2020-0481 | Low | 3.3 | 2020-12-15 | In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast… |
CVE-2020-0479 | High | 7.8 | 2020-12-15 | In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app t… |
CVE-2020-0473 | Medium | 4.6 | 2020-12-15 | In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. This could lead to local escalation of privi… |
CVE-2020-8919 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST AP… |
CVE-2020-29454 | Medium | 4.3 | 2020-12-02 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access. |
CVE-2020-26250 | Medium | 6.3 | 2020-12-01 | OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configur… |
CVE-2020-29374 | Low | 3.6 | 2020-11-28 | An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for… |
CVE-2020-15248 | Medium | 4.0 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, ba… |
CVE-2020-15246 | High | 7.5 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an… |
CVE-2020-28053 | Medium | 6.5 | 2020-11-23 | HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration… |
CVE-2020-28211 | High | 7.8 | 2020-11-19 | A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass… |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25699 | High | 7.5 | 2020-11-19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Ve… |
CVE-2020-8278 | Medium | 5.3 | 2020-11-19 | Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. |
CVE-2020-26223 | High | 7.7 | 2020-11-13 | Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is… |
CVE-2020-11209 | Medium | 5.5 | 2020-11-12 | Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P… |
CVE-2020-17049 | Medium | 6.6 | 2020-11-11 | A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos… |
CVE-2020-25655 | Medium | 5.7 | 2020-11-09 | An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admi… |
CVE-2020-24401 | Medium | 6.5 | 2020-11-09 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under… |
CVE-2020-3600 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3592 | Medium | 6.5 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization an… |
CVE-2020-26506 | Medium | 4.3 | 2020-11-05 | An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploade… |
CVE-2020-15278 | High | 7.7 | 2020-10-28 | Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privileg… |
CVE-2020-3852 | Medium | 5.3 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia… |
CVE-2020-3578 | Medium | 5.3 | 2020-10-21 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-27609 | Medium | 5.3 | 2020-10-21 | BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond… |
CVE-2020-6362 | Medium | 6.5 | 2020-10-20 | SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthoriza… |
CVE-2020-16904 | Medium | 5.3 | 2020-10-16 | <p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploite… |
CVE-2020-12503 | High | 7.2 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-27156 | Critical | 9.8 | 2020-10-15 | Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthentic… |
CVE-2020-13957 | Critical | 9.8 | 2020-10-13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code executi… |
CVE-2020-15251 | High | 7.7 | 2020-10-13 | In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypa… |
CVE-2020-3467 | High | 7.7 | 2020-10-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of… |
CVE-2020-13335 | Medium | 4.3 | 2020-10-07 | Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their grou… |
CVE-2020-13334 | Medium | 5.9 | 2020-10-07 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attri… |
CVE-2019-19200 | High | 8.8 | 2020-10-06 | REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users. |
CVE-2020-15664 | Medium | 6.5 | 2020-10-01 | By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would… |
CVE-2020-13322 | High | 7.2 | 2020-09-30 | A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy to… |
CVE-2020-26121 | High | 7.5 | 2020-09-27 | An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against… |
CVE-2020-25869 | High | 7.5 | 2020-09-27 | An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the corre… |
CVE-2020-3477 | Medium | 5.5 | 2020-09-24 | A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash… |
CVE-2020-3474 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3404 | High | 7.8 | 2020-09-24 | A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on a… |
CVE-2020-4621 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IB… |
CVE-2020-2258 | Medium | 4.3 | 2020-09-16 | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall… |
CVE-2020-15590 | High | 7.5 | 2020-09-14 | A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechan… |
CVE-2020-13313 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to t… |