CWE-863 · Incorrect Authorization (page 34)
Page 34 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1192 | Medium | 4.3 | 2019-08-14 | A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability allows Microsoft brow… |
CVE-2019-13417 | Medium | 5.3 | 2019-08-12 | Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user… |
CVE-2019-14924 | High | 7.5 | 2019-08-10 | An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAb… |
CVE-2018-20826 | Medium | 4.3 | 2019-08-09 | The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation c… |
CVE-2019-1912 | Critical | 9.1 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-13386 | High | 8.8 | 2019-07-26 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., o… |
CVE-2019-11724 | Medium | 6.1 | 2019-07-23 | Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another si… |
CVE-2019-1010084 | Medium | 6.5 | 2019-07-17 | Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is… |
CVE-2019-5220 | Medium | 4.6 | 2019-07-10 | There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker coul… |
CVE-2019-9149 | Medium | 6.5 | 2019-07-09 | Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker i… |
CVE-2019-13337 | High | 7.5 | 2019-07-09 | In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API)… |
CVE-2019-5602 | High | 8.8 | 2019-07-03 | In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE befor… |
CVE-2019-7258 | High | 8.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Privilege Escalation. |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2019-5838 | Medium | 4.3 | 2019-06-27 | Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2019-1626 | High | 8.8 | 2019-06-20 | A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on… |
CVE-2019-6582 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-12492 | Medium | 6.5 | 2019-06-06 | Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the F… |
CVE-2018-13382 | Critical | 9.1 | 2019-06-04 | An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1… |
CVE-2019-3403 | Medium | 5.3 | 2019-05-22 | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 a… |
CVE-2019-3401 | Medium | 5.3 | 2019-05-22 | The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an… |
CVE-2019-3399 | High | 7.5 | 2019-04-30 | The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for arch… |
CVE-2019-7304 | Critical | 9.8 | 2019-04-23 | Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects… |
CVE-2019-6570 | High | 8.8 | 2019-04-17 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may ac… |
CVE-2019-3842 | High | 7.0 | 2019-04-09 | In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible fo… |
CVE-2019-0732 | High | 7.8 | 2019-04-09 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUA… |
CVE-2019-3887 | Medium | 5.6 | 2019-04-09 | A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest cou… |
CVE-2018-15640 | High | 8.8 | 2019-04-09 | Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craf… |
CVE-2019-0762 | Medium | 4.3 | 2019-04-09 | A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Featur… |
CVE-2019-0761 | Medium | 6.5 | 2019-04-09 | A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific URLs, aka 'Internet… |
CVE-2019-0678 | Medium | 6.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access inf… |
CVE-2019-3848 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the ca… |
CVE-2019-3831 | Medium | 6.7 | 2019-03-25 | A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could b… |
CVE-2019-3827 | High | 7.0 | 2019-03-25 | An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users w… |
CVE-2019-10014 | Medium | 6.5 | 2019-03-24 | In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because th… |
CVE-2018-19515 | Critical | 9.8 | 2019-03-21 | In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atment_sddd… |
CVE-2019-0276 | High | 8.8 | 2019-03-12 | Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check fo… |
CVE-2019-1604 | High | 7.8 | 2019-03-08 | A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an… |
CVE-2019-1603 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to escalate lower-level privileges to the administrator level… |
CVE-2018-18815 | Critical | 10.0 | 2019-03-07 | The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for Active… |
CVE-2018-8790 | High | 7.8 | 2019-03-01 | Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM. |
CVE-2018-12391 | High | 8.8 | 2019-02-28 | During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in… |
CVE-2019-1667 | Low | 3.3 | 2019-02-21 | A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite inte… |
CVE-2019-0105 | High | 7.8 | 2019-02-18 | Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially… |
CVE-2019-7639 | High | 8.1 | 2019-02-08 | An issue was discovered in gsi-openssh-server 7.9p1 on Fedora 29. If PermitPAMUserChange is set to yes in the /etc/gsissh/sshd_config file, logins succeed with… |
CVE-2018-10910 | Medium | 4.5 | 2019-01-28 | A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead… |
CVE-2018-14666 | Medium | 6.8 | 2019-01-22 | An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Ha… |
CVE-2017-8276 | High | 7.8 | 2019-01-18 | Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, S… |
CVE-2018-5741 | Medium | 6.5 | 2019-01-16 | To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Variou… |
CVE-2018-20685 | Medium | 5.3 | 2019-01-10 | In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact… |
CVE-2018-1000420 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to… |
CVE-2018-1000418 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read acce… |
CVE-2018-1000412 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have… |
CVE-2019-0552 | High | 8.8 | 2019-01-08 | An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Wi… |
CVE-2018-7366 | Medium | 4.3 | 2018-12-28 | ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGT… |
CVE-2018-15465 | High | 8.1 | 2018-12-24 | A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and… |
CVE-2018-17195 | High | 7.5 | 2018-12-19 | The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resultin… |
CVE-2018-20147 | Medium | 6.5 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. |
CVE-2018-15774 | Low | 3.8 | 2018-12-13 | Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalat… |
CVE-2018-15754 | Medium | 4.2 | 2018-12-13 | Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts acro… |
CVE-2018-17950 | High | 7.5 | 2018-12-12 | Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 |
CVE-2018-18397 | Medium | 5.5 | 2018-12-12 | The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local u… |
CVE-2018-2494 | High | 8.0 | 2018-12-11 | Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 7… |
CVE-2018-7079 | High | 7.2 | 2018-12-07 | Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, w… |
CVE-2018-15767 | High | 8.8 | 2018-11-30 | The Dell OpenManage Network Manager virtual appliance versions prior to 6.5.3 contain an improper authorization vulnerability caused by a misconfiguration in t… |
CVE-2018-14748 | High | 7.5 | 2018-11-28 | Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier vers… |
CVE-2018-7988 | Medium | 4.6 | 2018-11-27 | There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker uses… |
CVE-2018-13356 | High | 8.8 | 2018-11-27 | Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions. |
CVE-2018-13324 | Critical | 9.8 | 2018-11-26 | Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header. |
CVE-2018-18955 | High | 7.0 | 2018-11-16 | In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user n… |
CVE-2018-15693 | Medium | 6.4 | 2018-11-16 | Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference. |
CVE-2018-15692 | Medium | 6.4 | 2018-11-16 | Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions. |
CVE-2018-7363 | Medium | 4.3 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization de… |
CVE-2018-16620 | High | 7.5 | 2018-11-15 | Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control. |
CVE-2018-6980 | High | 7.2 | 2018-11-13 | VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method… |
CVE-2018-7926 | Medium | 4.6 | 2018-11-13 | Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. Due to improper permission configuration for spe… |
CVE-2018-7925 | Medium | 6.8 | 2018-11-13 | The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability. An unauthenticated attacker… |
CVE-2018-9488 | High | 7.8 | 2018-11-06 | In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, wi… |
CVE-2018-14665 | Medium | 6.6 | 2018-10-25 | A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unpri… |
CVE-2018-12369 | Critical | 9.8 | 2018-10-18 | WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser… |
CVE-2018-17857 | Medium | 4.3 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation. |
CVE-2018-1000805 | High | 8.8 | 2018-10-08 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This… |
CVE-2018-15405 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an… |
CVE-2018-0460 | Medium | 6.5 | 2018-10-05 | A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an af… |
CVE-2018-0459 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to… |
CVE-2018-9492 | High | 7.8 | 2018-10-02 | In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with… |
CVE-2018-1250 | Medium | 6.5 | 2018-09-28 | Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially ex… |
CVE-2018-16597 | Medium | 5.5 | 2018-09-21 | An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate fi… |
CVE-2018-7929 | Medium | 6.8 | 2018-09-18 | Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. An attacker could unlock and use the pho… |
CVE-2018-1999047 | Medium | 6.5 | 2018-08-23 | A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins… |
CVE-2018-15468 | Medium | 6.0 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In part… |
CVE-2018-10925 | High | 8.1 | 2018-08-09 | It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involve… |
CVE-2018-3778 | Medium | 5.3 | 2018-08-08 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. |
CVE-2018-5489 | Medium | 6.5 | 2018-08-03 | NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administ… |
CVE-2018-7957 | Low | 3.3 | 2018-07-31 | Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization co… |
CVE-2017-17708 | Medium | 4.3 | 2018-07-31 | Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before… |
CVE-2017-2632 | Medium | 4.9 | 2018-07-27 | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level th… |
CVE-2017-7470 | Medium | 6.5 | 2018-07-27 | It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check i… |
CVE-2018-11047 | High | 7.5 | 2018-07-24 | Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly a… |
CVE-2017-3183 | High | 8.8 | 2018-07-24 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to pr… |