CWE-863 · Incorrect Authorization (page 35)
Page 35 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43781 | Medium | 6.4 | 2021-12-06 | Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versi… |
CVE-2021-24917 | High | 7.5 | 2021-12-06 | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to… |
CVE-2021-4026 | Medium | 4.3 | 2021-11-30 | bookstack is vulnerable to Improper Access Control |
CVE-2021-24842 | Medium | 5.4 | 2021-11-29 | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titl… |
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-22966 | High | 8.8 | 2021-11-19 | Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate pag… |
CVE-2021-39234 | Medium | 6.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypas… |
CVE-2021-43553 | Low | 3.1 | 2021-11-17 | PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a L… |
CVE-2021-24851 | Medium | 4.3 | 2021-11-17 | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardl… |
CVE-2021-41244 | Critical | 9.1 | 2021-11-15 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and ther… |
CVE-2021-3577 | High | 8.8 | 2021-11-12 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same n… |
CVE-2021-1903 | Medium | 5.3 | 2021-11-12 | Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response frame in Snapdragon Aut… |
CVE-2021-40504 | Medium | 4.9 | 2021-11-10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 7… |
CVE-2021-20119 | High | 7.1 | 2021-11-09 | The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. |
CVE-2021-42026 | Medium | 4.3 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-42025 | Medium | 6.5 | 2021-11-09 | A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2)… |
CVE-2021-24788 | Medium | 6.5 | 2021-11-08 | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any a… |
CVE-2021-24783 | Medium | 6.5 | 2021-11-08 | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to… |
CVE-2021-22051 | Medium | 6.5 | 2021-11-08 | Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affec… |
CVE-2021-41230 | Medium | 5.3 | 2021-11-05 | Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in poli… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-39904 | Medium | 4.3 | 2021-11-05 | An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 b… |
CVE-2021-39902 | Medium | 4.3 | 2021-11-04 | Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. |
CVE-2021-21693 | Critical | 9.8 | 2021-11-04 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2… |
CVE-2021-39341 | High | 8.2 | 2021-11-01 | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validati… |
CVE-2021-24770 | Medium | 6.5 | 2021-11-01 | The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users… |
CVE-2021-24757 | Medium | 5.3 | 2021-11-01 | The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticate… |
CVE-2021-24742 | Medium | 6.5 | 2021-11-01 | The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it us… |
CVE-2021-24717 | High | 8.8 | 2021-11-01 | The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose ti… |
CVE-2021-41189 | High | 7.2 | 2021-10-29 | DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become s… |
CVE-2021-39321 | High | 8.8 | 2021-10-21 | Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to de… |
CVE-2021-38345 | High | 7.1 | 2021-10-14 | The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-ad… |
CVE-2021-20803 | Medium | 5.4 | 2021-10-13 | Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alter the data of the m… |
CVE-2021-40456 | Medium | 5.3 | 2021-10-13 | Windows AD FS Security Feature Bypass Vulnerability |
CVE-2021-42137 | Medium | 5.3 | 2021-10-11 | An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that sh… |
CVE-2021-28661 | Medium | 4.3 | 2021-10-07 | Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass. |
CVE-2021-22262 | Medium | 5.4 | 2021-10-05 | Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from… |
CVE-2021-41093 | High | 7.4 | 2021-10-04 | Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing t… |
CVE-2021-22535 | Medium | 4.9 | 2021-09-28 | Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior… |
CVE-2021-24652 | Medium | 6.5 | 2021-09-27 | The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax bas… |
CVE-2021-40655 | High | 7.5 | 2021-09-24 | An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request… |
CVE-2021-40654 | Medium | 6.5 | 2021-09-24 | An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.ph… |
CVE-2021-36749 | Medium | 6.5 | 2021-09-24 | In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2020-19551 | High | 8.8 | 2021-09-21 | Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong. |
CVE-2021-41082 | High | 7.5 | 2021-09-20 | Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed t… |
CVE-2020-16630 | Medium | 6.8 | 2021-09-20 | TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an… |
CVE-2019-16651 | Medium | 5.3 | 2021-09-20 | An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is… |
CVE-2021-40639 | High | 7.5 | 2021-09-15 | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
CVE-2020-21124 | Critical | 9.8 | 2021-09-15 | UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page. |
CVE-2021-39206 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 an… |
CVE-2021-28911 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial… |
CVE-2021-22239 | Medium | 5.0 | 2021-09-09 | An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. |
CVE-2021-28567 | Medium | 6.5 | 2021-09-08 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the custom… |
CVE-2021-35526 | Medium | 6.3 | 2021-09-08 | Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive infor… |
CVE-2021-1854 | Medium | 4.3 | 2021-09-08 | A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically a… |
CVE-2020-19765 | High | 7.5 | 2021-09-07 | An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack. |
CVE-2021-35949 | Medium | 5.3 | 2021-09-07 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about… |
CVE-2021-38312 | High | 7.1 | 2021-09-02 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered unde… |
CVE-2021-39119 | Medium | 5.3 | 2021-09-01 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Ji… |
CVE-2021-36039 | Medium | 6.5 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via th… |
CVE-2021-39164 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list… |
CVE-2021-39163 | Low | 3.1 | 2021-08-31 | Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, to… |
CVE-2021-34434 | Medium | 5.3 | 2021-08-30 | In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked wh… |
CVE-2021-28696 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-22256 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status |
CVE-2021-22247 | Medium | 4.3 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics |
CVE-2021-22243 | Medium | 5.0 | 2021-08-25 | Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain… |
CVE-2021-22236 | Medium | 5.5 | 2021-08-25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present… |
CVE-2021-39156 | High | 8.1 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-39155 | High | 8.3 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-32779 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled… |
CVE-2021-32777 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension… |
CVE-2021-30987 | Medium | 5.5 | 2021-08-24 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked via BSSIDs. |
CVE-2021-30975 | High | 8.6 | 2021-08-24 | This issue was addressed by disabling execution of JavaScript when viewing a scripting dictionary. This issue is fixed in macOS Monterey 12.1, Security Update… |
CVE-2021-30972 | Medium | 5.5 | 2021-08-24 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-001 Catalina, macOS Big Sur 11.6.3. A malicious application may be a… |
CVE-2021-30925 | Critical | 9.1 | 2021-08-24 | The issue was addressed with improved permissions logic. This issue is fixed in watchOS 8, macOS Big Sur 11.6, iOS 15 and iPadOS 15. A malicious application ma… |
CVE-2021-30856 | Critical | 9.1 | 2021-08-24 | This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions. This issue is fixed in macOS Big Sur 1… |
CVE-2021-26040 | Critical | 9.1 | 2021-08-24 | An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. |
CVE-2021-22253 | Medium | 4.9 | 2021-08-23 | Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protecte… |
CVE-2021-22251 | Medium | 4.3 | 2021-08-23 | Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain th… |
CVE-2021-37598 | Medium | 5.3 | 2021-08-19 | WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character. |
CVE-2021-39138 | Medium | 4.8 | 2021-08-19 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and als… |
CVE-2021-0645 | High | 7.8 | 2021-08-17 | In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an a… |
CVE-2021-32829 | Critical | 9.6 | 2021-08-17 | ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by… |
CVE-2020-18701 | Critical | 9.8 | 2021-08-16 | Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not inva… |
CVE-2021-37705 | Critical | 10.0 | 2021-08-13 | OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe… |
CVE-2021-27793 | Medium | 5.3 | 2021-08-12 | ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS be… |
CVE-2020-25564 | High | 8.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSa… |
CVE-2020-28397 | Medium | 5.3 | 2021-08-10 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS v… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2021-38137 | High | 8.1 | 2021-08-06 | Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to perform actions not b… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2021-33335 | High | 7.2 | 2021-08-03 | Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authe… |
CVE-2020-19301 | Critical | 9.8 | 2021-08-03 | A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition param… |
CVE-2021-30571 | Critical | 9.6 | 2021-08-03 | Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2021-22398 | Medium | 4.6 | 2021-08-02 | There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on… |
CVE-2021-22389 | Critical | 9.8 | 2021-08-02 | There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be executed. |
CVE-2021-22521 | Medium | 6.7 | 2021-07-30 | A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versi… |