CWE-863 · Incorrect Authorization (page 37)
Page 37 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28821 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO E… |
CVE-2021-28819 | High | 8.8 | 2021-03-23 | The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition co… |
CVE-2021-28146 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication se… |
CVE-2021-28791 | High | 7.8 | 2021-03-18 | The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspac… |
CVE-2021-21624 | Medium | 4.3 | 2021-03-18 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to… |
CVE-2021-21623 | Medium | 6.5 | 2021-03-18 | An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to a… |
CVE-2021-28681 | Medium | 5.3 | 2021-03-18 | Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a… |
CVE-2021-20676 | Medium | 4.3 | 2021-03-18 | M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D)… |
CVE-2020-24264 | Critical | 9.8 | 2021-03-16 | Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts a… |
CVE-2021-20283 | Medium | 4.3 | 2021-03-15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in eac… |
CVE-2021-20282 | Medium | 5.3 | 2021-03-15 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5… |
CVE-2021-20281 | Medium | 5.3 | 2021-03-15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3… |
CVE-2020-25240 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An at… |
CVE-2020-25239 | High | 8.8 | 2021-03-15 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for… |
CVE-2021-20179 | High | 8.1 | 2021-03-15 | A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again… |
CVE-2021-28373 | High | 7.5 | 2021-03-13 | The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this iss… |
CVE-2020-35682 | High | 8.8 | 2021-03-13 | Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login). |
CVE-2021-21367 | Medium | 6.1 | 2021-03-12 | Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetoo… |
CVE-2021-0382 | Medium | 5.5 | 2021-03-10 | In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local infor… |
CVE-2021-0376 | High | 7.8 | 2021-03-10 | In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lea… |
CVE-2021-21186 | Medium | 4.3 | 2021-03-09 | Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by… |
CVE-2021-21182 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2021-21484 | Critical | 9.8 | 2021-03-09 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. |
CVE-2021-21481 | High | 8.8 | 2021-03-09 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might all… |
CVE-2021-22134 | Medium | 4.3 | 2021-03-08 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not… |
CVE-2021-21362 | High | 7.7 | 2021-03-08 | MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE… |
CVE-2020-29020 | Critical | 9.1 | 2021-03-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows remote attacker to access the web UI from the internet using the configured… |
CVE-2021-27099 | Medium | 6.8 | 2021-03-05 | In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID temp… |
CVE-2021-26964 | High | 7.1 | 2021-03-05 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in… |
CVE-2021-21725 | Medium | 5.7 | 2021-03-05 | A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by pe… |
CVE-2021-26027 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article. |
CVE-2021-27225 | Medium | 5.4 | 2021-03-01 | In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite… |
CVE-2021-26563 | High | 8.2 | 2021-02-26 | Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary co… |
CVE-2021-20229 | Medium | 4.3 | 2021-02-23 | A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all c… |
CVE-2021-22113 | Medium | 5.3 | 2021-02-23 | Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Hea… |
CVE-2021-27509 | High | 7.5 | 2021-02-19 | In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. |
CVE-2020-12668 | Medium | 6.5 | 2021-02-19 | Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the appl… |
CVE-2021-21318 | Medium | 5.4 | 2021-02-18 | Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerabil… |
CVE-2021-26753 | Critical | 9.9 | 2021-02-12 | NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This… |
CVE-2021-20188 | High | 7.0 | 2021-02-11 | A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abus… |
CVE-2021-27177 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3… |
CVE-2020-8806 | High | 7.5 | 2021-02-05 | Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected beca… |
CVE-2020-27873 | Medium | 6.5 | 2021-02-04 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authe… |
CVE-2021-25777 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. |
CVE-2021-25774 | Medium | 4.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. |
CVE-2019-25017 | Medium | 5.9 | 2021-02-02 | An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/direct… |
CVE-2021-21286 | High | 7.7 | 2021-02-01 | AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authoriz… |
CVE-2021-21276 | Critical | 9.3 | 2021-02-01 | Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instance… |
CVE-2020-29605 | Medium | 4.3 | 2021-01-29 | An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access… |
CVE-2021-3337 | High | 7.5 | 2021-01-28 | The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quot… |
CVE-2020-1725 | Medium | 5.4 | 2021-01-28 | A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and af… |
CVE-2021-26026 | High | 7.8 | 2021-01-26 | PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a… |
CVE-2021-26025 | High | 7.8 | 2021-01-26 | PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a… |
CVE-2020-9492 | High | 8.8 | 2021-01-26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without… |
CVE-2021-1305 | High | 8.8 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authori… |
CVE-2021-1270 | Medium | 6.3 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to vie… |
CVE-2021-1269 | Medium | 6.3 | 2021-01-20 | Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to vie… |
CVE-2020-4873 | Medium | 5.3 | 2021-01-19 | IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836. |
CVE-2021-21013 | High | 8.1 | 2021-01-13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the cu… |
CVE-2021-1144 | High | 8.8 | 2021-01-13 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the passwor… |
CVE-2021-1143 | Medium | 4.3 | 2021-01-13 | A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on t… |
CVE-2021-21609 | Medium | 5.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without O… |
CVE-2021-0319 | High | 7.3 | 2021-01-11 | In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address without appropriate perm… |
CVE-2021-0317 | High | 7.8 | 2021-01-11 | In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of pri… |
CVE-2018-8724 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr… |
CVE-2018-8044 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K… |
CVE-2021-1054 | Medium | 5.5 | 2021-01-08 | NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the so… |
CVE-2020-35948 | Critical | 9.9 | 2021-01-01 | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary f… |
CVE-2016-20005 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advis… |
CVE-2016-20004 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory p… |
CVE-2016-20002 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2016-20001 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory po… |
CVE-2020-26029 | Medium | 6.5 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On-Behalf-Of. The authorization checks ar… |
CVE-2020-26028 | Medium | 4.9 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. |
CVE-2020-24674 | High | 8.8 | 2020-12-22 | In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execu… |
CVE-2020-4794 | Medium | 5.4 | 2020-12-21 | IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could all… |
CVE-2020-0481 | Low | 3.3 | 2020-12-15 | In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast… |
CVE-2020-0479 | High | 7.8 | 2020-12-15 | In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app t… |
CVE-2020-0473 | Medium | 4.6 | 2020-12-15 | In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. This could lead to local escalation of privi… |
CVE-2020-8919 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST AP… |
CVE-2020-29454 | Medium | 4.3 | 2020-12-02 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access. |
CVE-2020-26250 | Medium | 6.3 | 2020-12-01 | OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configur… |
CVE-2020-29374 | Low | 3.6 | 2020-11-28 | An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for… |
CVE-2020-15248 | Medium | 4.0 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, ba… |
CVE-2020-15246 | High | 7.5 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an… |
CVE-2020-28053 | Medium | 6.5 | 2020-11-23 | HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration… |
CVE-2020-28211 | High | 7.8 | 2020-11-19 | A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass… |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25699 | High | 7.5 | 2020-11-19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Ve… |
CVE-2020-8278 | Medium | 5.3 | 2020-11-19 | Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. |
CVE-2020-26223 | High | 7.7 | 2020-11-13 | Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is… |
CVE-2020-11209 | Medium | 5.5 | 2020-11-12 | Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P… |
CVE-2020-17049 | Medium | 6.6 | 2020-11-11 | A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos… |
CVE-2020-25655 | Medium | 5.7 | 2020-11-09 | An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admi… |
CVE-2020-24401 | Medium | 6.5 | 2020-11-09 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under… |
CVE-2020-3600 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3592 | Medium | 6.5 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization an… |
CVE-2020-26506 | Medium | 4.3 | 2020-11-05 | An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploade… |
CVE-2020-15278 | High | 7.7 | 2020-10-28 | Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privileg… |
CVE-2020-3852 | Medium | 5.3 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia… |