CWE-863 · Incorrect Authorization (page 33)
Page 33 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5251 | High | 7.7 | 2020-03-04 | In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionT… |
CVE-2020-9381 | High | 7.5 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in c… |
CVE-2019-4745 | Medium | 4.3 | 2020-02-24 | IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information… |
CVE-2014-7914 | High | 8.1 | 2020-02-21 | btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to… |
CVE-2020-5242 | High | 7.7 | 2020-02-20 | openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the… |
CVE-2013-4228 | Medium | 4.3 | 2020-02-18 | The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to pr… |
CVE-2020-7251 | Medium | 5.0 | 2020-02-14 | Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to… |
CVE-2020-5239 | High | 8.7 | 2020-02-13 | In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu server… |
CVE-2020-6380 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2020-5318 | High | 7.5 | 2020-02-06 | Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability… |
CVE-2020-8119 | Medium | 4.3 | 2020-02-04 | Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. |
CVE-2013-2673 | Medium | 6.8 | 2020-02-03 | Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access. |
CVE-2020-7955 | Medium | 5.3 | 2020-01-31 | HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended informati… |
CVE-2013-2198 | Critical | 9.8 | 2020-01-30 | The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username. |
CVE-2013-1350 | Critical | 9.1 | 2020-01-30 | Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities |
CVE-2013-2574 | High | 7.5 | 2020-01-29 | An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malic… |
CVE-2020-2104 | Medium | 4.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. |
CVE-2020-8086 | Critical | 9.8 | 2020-01-28 | The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. T… |
CVE-2013-4862 | High | 8.1 | 2020-01-28 | MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squash… |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2019-17190 | High | 7.8 | 2020-01-27 | A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpd… |
CVE-2020-2097 | High | 8.8 | 2020-01-15 | Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to exe… |
CVE-2020-6307 | Medium | 4.3 | 2020-01-14 | Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization… |
CVE-2012-3821 | Medium | 4.3 | 2020-01-10 | A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify… |
CVE-2012-3822 | High | 7.5 | 2020-01-10 | Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials. |
CVE-2019-17014 | High | 7.4 | 2020-01-08 | If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin info… |
CVE-2016-6591 | High | 7.1 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let a local malicious u… |
CVE-2019-14843 | High | 8.8 | 2020-01-07 | A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app… |
CVE-2019-6855 | High | 7.3 | 2020-01-06 | Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all ve… |
CVE-2014-0169 | Medium | 6.5 | 2020-01-02 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an auth… |
CVE-2010-3782 | High | 8.8 | 2020-01-02 | obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation. |
CVE-2019-20213 | High | 7.5 | 2020-01-02 | D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. |
CVE-2019-12837 | Medium | 4.3 | 2019-12-31 | The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints. |
CVE-2018-20498 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20494 | High | 7.5 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20493 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-4343 | Medium | 6.5 | 2019-12-30 | IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An att… |
CVE-2013-4985 | High | 7.5 | 2019-12-27 | Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream |
CVE-2018-20492 | Medium | 5.3 | 2019-12-26 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-19681 | High | 8.8 | 2019-12-26 | Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and exec… |
CVE-2019-19984 | Medium | 6.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and ema… |
CVE-2017-16778 | Medium | 4.6 | 2019-12-24 | An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to inv… |
CVE-2012-6094 | Critical | 9.8 | 2019-12-20 | cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system |
CVE-2019-11294 | Medium | 4.3 | 2019-12-19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs… |
CVE-2019-8512 | Medium | 5.7 | 2019-12-18 | This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their d… |
CVE-2019-0384 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0383 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-7192 | Critical | 9.8 | 2019-12-05 | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend upda… |
CVE-2019-19597 | High | 8.8 | 2019-12-05 | D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH… |
CVE-2019-19520 | High | 7.8 | 2019-12-05 | xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/m… |
CVE-2013-4411 | Medium | 4.3 | 2019-12-03 | Review Board: URL processing gives unauthorized users access to review lists |
CVE-2013-4410 | High | 7.5 | 2019-12-02 | ReviewBoard: has an access-control problem in REST API |
CVE-2016-6353 | Medium | 6.5 | 2019-11-26 | Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the R… |
CVE-2016-4572 | High | 8.8 | 2019-11-26 | In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges. |
CVE-2016-3131 | Medium | 6.5 | 2019-11-26 | Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls. |
CVE-2011-3617 | Medium | 6.5 | 2019-11-26 | Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. |
CVE-2019-5879 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2019-5864 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass… |
CVE-2019-13716 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2019-16538 | High | 8.8 | 2019-11-21 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed… |
CVE-2012-2238 | High | 7.5 | 2019-11-21 | trytond 2.4: ModelView.button fails to validate authorization |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2019-18949 | High | 7.5 | 2019-11-14 | SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webp… |
CVE-2011-1070 | High | 7.8 | 2019-11-14 | v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and pote… |
CVE-2019-5231 | Medium | 4.6 | 2019-11-13 | P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an… |
CVE-2018-18819 | Medium | 5.3 | 2019-11-12 | A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202)… |
CVE-2019-4509 | Medium | 4.3 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive infor… |
CVE-2019-12419 | Critical | 9.8 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability i… |
CVE-2010-2548 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. |
CVE-2018-21030 | Medium | 5.3 | 2019-10-31 | Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be place… |
CVE-2019-5533 | Medium | 4.3 | 2019-10-29 | In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtai… |
CVE-2009-3723 | High | 7.5 | 2019-10-29 | asterisk allows calls on prohibited networks |
CVE-2019-4311 | Medium | 5.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further at… |
CVE-2019-6144 | Medium | 6.5 | 2019-10-23 | This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection. |
CVE-2019-15900 | Critical | 9.8 | 2019-10-18 | An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking… |
CVE-2019-14832 | High | 7.5 | 2019-10-15 | A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated att… |
CVE-2019-17191 | High | 7.5 | 2019-10-05 | The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a conne… |
CVE-2019-9364 | Low | 3.3 | 2019-09-27 | In AudioService, there is a possible trigger of background user audio due to a permissions bypass. This could lead to local information disclosure by playing t… |
CVE-2019-9272 | Medium | 5.5 | 2019-09-27 | In WiFi, there is a possible leak of WiFi state due to a permissions bypass. This could lead to a local information disclosure which could be used to determine… |
CVE-2019-12671 | High | 7.8 | 2019-09-25 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute command… |
CVE-2019-15941 | Critical | 9.8 | 2019-09-25 | OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization reques… |
CVE-2019-12648 | High | 8.8 | 2019-09-25 | A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Gues… |
CVE-2019-16884 | High | 7.5 | 2019-09-25 | runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorr… |
CVE-2016-10996 | Medium | 5.3 | 2019-09-20 | The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. |
CVE-2019-6838 | Medium | 6.5 | 2019-09-17 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG626… |
CVE-2019-6836 | High | 7.5 | 2019-09-17 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG626… |
CVE-2019-15729 | High | 7.5 | 2019-09-17 | An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the la… |
CVE-2019-14237 | Critical | 9.8 | 2019-09-12 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeat… |
CVE-2019-14236 | Critical | 9.8 | 2019-09-12 | On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection… |
CVE-2019-1289 | Medium | 5.5 | 2019-09-11 | An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissions, aka 'Windows Upd… |
CVE-2019-14995 | Medium | 5.3 | 2019-09-11 | The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and… |
CVE-2019-16114 | Critical | 9.8 | 2019-09-09 | In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to t… |
CVE-2019-14813 | Critical | 9.8 | 2019-09-06 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scr… |
CVE-2019-2175 | High | 7.8 | 2019-09-05 | In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect order of arguments. This could lead to l… |
CVE-2019-14817 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabl… |
CVE-2019-14811 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-11247 | High | 8.1 | 2019-08-29 | The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authoriza… |
CVE-2019-8446 | Medium | 5.3 | 2019-08-23 | The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. |
CVE-2019-8445 | Medium | 5.3 | 2019-08-23 | Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time informati… |