CWE-863 · Incorrect Authorization (page 36)
Page 36 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36091 | Low | 3.5 | 2021-07-26 | Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1… |
CVE-2021-36230 | High | 8.8 | 2021-07-20 | HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token… |
CVE-2021-36758 | Medium | 5.4 | 2021-07-16 | 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privi… |
CVE-2020-12733 | High | 7.5 | 2021-07-15 | Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the molinkadmin passwo… |
CVE-2021-33718 | Medium | 5.3 | 2021-07-13 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7… |
CVE-2021-22515 | Medium | 4.8 | 2021-07-12 | Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions pri… |
CVE-2021-26273 | High | 7.8 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Incorrect Access Control. |
CVE-2021-24405 | Medium | 6.5 | 2021-07-06 | The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (suc… |
CVE-2021-36132 | High | 8.8 | 2021-07-02 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variabl… |
CVE-2021-35197 | High | 7.5 | 2021-07-02 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "… |
CVE-2020-27362 | High | 8.8 | 2021-07-01 | An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file e… |
CVE-2021-27661 | High | 8.8 | 2021-07-01 | Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-29961 | Medium | 4.3 | 2021-06-24 | When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface… |
CVE-2021-29959 | Medium | 4.3 | 2021-06-24 | When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it wit… |
CVE-2021-32701 | High | 7.5 | 2021-06-22 | ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a… |
CVE-2010-2525 | High | 7.8 | 2021-06-22 | A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or e… |
CVE-2021-0571 | High | 7.8 | 2021-06-22 | In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access… |
CVE-2010-1435 | Critical | 9.8 | 2021-06-21 | Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently re… |
CVE-2021-24379 | Medium | 5.3 | 2021-06-21 | The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX req… |
CVE-2020-20471 | High | 8.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate t… |
CVE-2020-20466 | Critical | 9.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user. |
CVE-2021-26845 | High | 7.5 | 2021-06-14 | Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report… |
CVE-2021-0472 | High | 7.8 | 2021-06-11 | In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to loc… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-25410 | High | 7.1 | 2021-06-11 | Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated pri… |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-21664 | Medium | 6.5 | 2021-06-10 | An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacke… |
CVE-2021-30539 | Medium | 5.4 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30538 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
CVE-2021-30537 | Medium | 4.3 | 2021-06-07 | Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. |
CVE-2021-30534 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2021-30533 | Medium | 6.5 | 2021-06-07 | Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2021-33881 | Medium | 4.2 | 2021-06-06 | On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter… |
CVE-2021-1540 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-1539 | High | 8.1 | 2021-06-04 | Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass author… |
CVE-2021-3469 | Medium | 5.4 | 2021-06-03 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-pr… |
CVE-2021-3499 | Medium | 5.6 | 2021-06-02 | A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there i… |
CVE-2021-20306 | Medium | 4.3 | 2021-06-01 | A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projec… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-32619 | Critical | 9.8 | 2021-05-28 | Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported thro… |
CVE-2021-29628 | High | 7.5 | 2021-05-28 | In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a… |
CVE-2020-1729 | Medium | 4.4 | 2021-05-28 | A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoa… |
CVE-2020-26560 | High | 8.1 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner… |
CVE-2020-26559 | High | 8.8 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the… |
CVE-2020-26555 | Medium | 5.4 | 2021-05-24 | Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of t… |
CVE-2021-21552 | Medium | 5.2 | 2021-05-21 | Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability. A local authenticated malicious user wi… |
CVE-2021-31158 | Medium | 6.5 | 2021-05-19 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allo… |
CVE-2021-20429 | Medium | 5.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 19633… |
CVE-2021-24282 | Medium | 6.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pl… |
CVE-2021-24281 | Medium | 4.3 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action… |
CVE-2021-24279 | Medium | 6.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to insta… |
CVE-2021-24278 | High | 7.5 | 2021-05-14 | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce f… |
CVE-2021-31876 | Medium | 6.5 | 2021-05-13 | Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a los… |
CVE-2021-3457 | Medium | 6.1 | 2021-05-12 | An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should b… |
CVE-2020-36289 | Medium | 5.3 | 2021-05-12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… |
CVE-2021-31165 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-20538 | Critical | 9.1 | 2021-05-10 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due… |
CVE-2021-23015 | High | 7.2 | 2021-05-10 | On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated… |
CVE-2021-31829 | Medium | 5.5 | 2021-05-06 | kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attack… |
CVE-2021-22209 | High | 7.5 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted… |
CVE-2021-24244 | Medium | 6.5 | 2021-05-06 | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low p… |
CVE-2021-22211 | Low | 3.1 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a… |
CVE-2021-21228 | Medium | 4.3 | 2021-04-30 | Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2021-31926 | Medium | 6.5 | 2021-04-30 | AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by cra… |
CVE-2021-1086 | High | 7.1 | 2021-04-29 | NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead t… |
CVE-2020-21990 | High | 7.5 | 2021-04-29 | Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access contro… |
CVE-2021-30638 | High | 7.5 | 2021-04-27 | Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constr… |
CVE-2021-29158 | Medium | 4.9 | 2021-04-23 | Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. |
CVE-2021-31554 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created Media… |
CVE-2021-31552 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after acc… |
CVE-2021-31548 | Medium | 6.5 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked coul… |
CVE-2021-28793 | Critical | 9.8 | 2021-04-20 | vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via… |
CVE-2021-3493 | High | 8.8 | 2021-04-17 | The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an unde… |
CVE-2021-29452 | High | 8.1 | 2021-04-16 | a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This fea… |
CVE-2021-28826 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging -… |
CVE-2021-28825 | High | 8.8 | 2021-04-14 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - E… |
CVE-2021-29439 | High | 7.2 | 2021-04-13 | The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can ins… |
CVE-2021-29437 | High | 8.0 | 2021-04-13 | ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a… |
CVE-2021-27086 | High | 7.8 | 2021-04-13 | Windows Services and Controller App Elevation of Privilege Vulnerability |
CVE-2021-29943 | Critical | 9.1 | 2021-04-13 | When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server… |
CVE-2019-15059 | High | 7.5 | 2021-04-12 | In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar with… |
CVE-2020-28872 | Critical | 9.8 | 2021-04-12 | An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid c… |
CVE-2021-25356 | High | 7.1 | 2021-04-09 | An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application… |
CVE-2020-36287 | Medium | 5.3 | 2021-04-09 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14… |
CVE-2020-14106 | Medium | 5.5 | 2021-04-08 | The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26. |
CVE-2021-24207 | Medium | 4.3 | 2021-04-05 | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles mu… |
CVE-2020-27901 | Medium | 6.3 | 2021-04-02 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007… |
CVE-2021-26718 | Medium | 5.5 | 2021-04-01 | KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. |
CVE-2020-36238 | Medium | 5.3 | 2021-04-01 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 befor… |
CVE-2021-29642 | Medium | 5.3 | 2021-03-30 | GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens. |
CVE-2021-28936 | High | 7.5 | 2021-03-29 | The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. T… |
CVE-2021-21411 | Medium | 5.5 | 2021-03-26 | OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based aut… |
CVE-2021-21389 | High | 8.1 | 2021-03-26 | BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged… |
CVE-2021-27195 | Medium | 5.9 | 2021-03-25 | Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic. |
CVE-2021-22186 | Medium | 4.9 | 2021-03-24 | An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners |
CVE-2021-22176 | Medium | 4.3 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on… |
CVE-2021-28824 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpa… |
CVE-2021-28823 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition… |