CWE-863 · Incorrect Authorization (page 38)
Page 38 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3578 | Medium | 5.3 | 2020-10-21 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-27609 | Medium | 5.3 | 2020-10-21 | BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond… |
CVE-2020-6362 | Medium | 6.5 | 2020-10-20 | SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthoriza… |
CVE-2020-16904 | Medium | 5.3 | 2020-10-16 | <p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploite… |
CVE-2020-12503 | High | 7.2 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-27156 | Critical | 9.8 | 2020-10-15 | Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthentic… |
CVE-2020-13957 | Critical | 9.8 | 2020-10-13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code executi… |
CVE-2020-15251 | High | 7.7 | 2020-10-13 | In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypa… |
CVE-2020-3467 | High | 7.7 | 2020-10-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of… |
CVE-2020-13335 | Medium | 4.3 | 2020-10-07 | Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their grou… |
CVE-2020-13334 | Medium | 5.9 | 2020-10-07 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attri… |
CVE-2019-19200 | High | 8.8 | 2020-10-06 | REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users. |
CVE-2020-15664 | Medium | 6.5 | 2020-10-01 | By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would… |
CVE-2020-13322 | High | 7.2 | 2020-09-30 | A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy to… |
CVE-2020-26121 | High | 7.5 | 2020-09-27 | An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against… |
CVE-2020-25869 | High | 7.5 | 2020-09-27 | An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the corre… |
CVE-2020-3477 | Medium | 5.5 | 2020-09-24 | A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash… |
CVE-2020-3474 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3404 | High | 7.8 | 2020-09-24 | A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on a… |
CVE-2020-4621 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IB… |
CVE-2020-2258 | Medium | 4.3 | 2020-09-16 | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall… |
CVE-2020-15590 | High | 7.5 | 2020-09-14 | A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechan… |
CVE-2020-13313 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to t… |
CVE-2020-13300 | High | 8.0 | 2020-09-14 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. |
CVE-2020-13284 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token |
CVE-2020-25284 | Medium | 4.1 | 2020-09-13 | The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could… |
CVE-2020-15163 | High | 8.7 | 2020-09-09 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which faile… |
CVE-2020-6311 | Medium | 6.5 | 2020-09-09 | Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform neces… |
CVE-2020-3530 | High | 8.4 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that comma… |
CVE-2020-3473 | High | 7.8 | 2020-09-04 | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate priv… |
CVE-2020-24941 | High | 7.5 | 2020-09-04 | An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON co… |
CVE-2020-5418 | Medium | 4.3 | 2020-09-03 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spa… |
CVE-2020-25025 | Medium | 4.3 | 2020-09-02 | The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fie… |
CVE-2020-25055 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged… |
CVE-2020-24716 | High | 7.8 | 2020-08-27 | OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. |
CVE-2020-3522 | Medium | 6.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to byp… |
CVE-2020-19005 | Medium | 5.7 | 2020-08-25 | zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file direc… |
CVE-2020-16241 | Medium | 6.3 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2020-9712 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass… |
CVE-2020-3472 | Medium | 5.0 | 2020-08-17 | A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitiv… |
CVE-2020-3413 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to delete a scheduled meeting t… |
CVE-2020-3412 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to create a scheduled meeting t… |
CVE-2020-8212 | Critical | 9.8 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix Xen… |
CVE-2020-7583 | High | 7.8 | 2020-08-14 | A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does… |
CVE-2020-7300 | Medium | 4.6 | 2020-08-12 | Improper Authorization vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attackers to change the con… |
CVE-2020-2233 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of… |
CVE-2020-17448 | High | 7.8 | 2020-08-11 | Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat… |
CVE-2020-12780 | High | 7.5 | 2020-08-10 | A security misconfiguration exists in Combodo iTop, which can expose sensitive information. |
CVE-2020-3386 | High | 8.8 | 2020-07-31 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with a low-privileged accoun… |
CVE-2020-3374 | Critical | 9.9 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, e… |
CVE-2020-14486 | Medium | 6.3 | 2020-07-29 | An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow… |
CVE-2020-15120 | Medium | 4.9 | 2020-07-27 | In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this othe… |
CVE-2020-15126 | Medium | 6.5 | 2020-07-22 | In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and… |
CVE-2020-15110 | Medium | 6.8 | 2020-07-17 | In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of ot… |
CVE-2020-3150 | Medium | 5.9 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco Small Business RV110W and RV215W Series Routers could allow an unauthenticated, remote attacker… |
CVE-2020-3140 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthori… |
CVE-2020-2228 | High | 8.8 | 2020-07-15 | Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. |
CVE-2020-7692 | High | 7.4 | 2020-07-09 | PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an author… |
CVE-2020-15513 | Medium | 5.3 | 2020-07-07 | The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control. |
CVE-2020-5372 | High | 8.6 | 2020-07-06 | Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that exposes test interface ports to external network. A remote unauthenticated att… |
CVE-2020-14196 | Medium | 5.3 | 2020-07-01 | In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced. |
CVE-2020-15084 | High | 7.7 | 2020-06-30 | In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms i… |
CVE-2020-12053 | Critical | 9.8 | 2020-06-22 | In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a privat… |
CVE-2020-13263 | High | 7.5 | 2020-06-19 | An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized user… |
CVE-2020-13277 | Medium | 6.3 | 2020-06-19 | An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5 |
CVE-2020-3364 | Medium | 5.3 | 2020-06-18 | A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unau… |
CVE-2020-3360 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive info… |
CVE-2020-6752 | Low | 3.8 | 2020-06-17 | In OMERO before 5.6.1, group owners can access members' data in other groups. |
CVE-2020-14214 | Medium | 6.5 | 2020-06-16 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new ac… |
CVE-2020-7499 | Medium | 6.5 | 2020-06-16 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which coul… |
CVE-2020-0115 | High | 7.8 | 2020-06-10 | In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary d… |
CVE-2020-13696 | Medium | 4.4 | 2020-06-08 | An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged call… |
CVE-2020-13834 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of And… |
CVE-2020-3335 | Medium | 5.5 | 2020-06-03 | A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of ot… |
CVE-2020-3231 | Medium | 4.7 | 2020-06-03 | A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent atta… |
CVE-2020-3229 | High | 8.8 | 2020-06-03 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacke… |
CVE-2020-3227 | Critical | 9.8 | 2020-06-03 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2020-4026 | Medium | 4.3 | 2020-06-03 | The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before… |
CVE-2020-11844 | Critical | 10.0 | 2020-05-29 | Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to… |
CVE-2020-1831 | Low | 2.4 | 2020-05-29 | HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function doe… |
CVE-2020-4249 | Medium | 6.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect… |
CVE-2020-12391 | High | 7.5 | 2020-05-26 | Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should hav… |
CVE-2020-3811 | High | 7.5 | 2020-05-26 | qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. |
CVE-2019-20801 | Medium | 5.3 | 2020-05-18 | An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any… |
CVE-2020-0097 | High | 7.8 | 2020-05-14 | In various methods of PackageManagerService.java, there is a possible permission bypass due to a missing condition for system apps. This could lead to local es… |
CVE-2020-12876 | High | 7.5 | 2020-05-14 | Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. This vulnerability only impacts Windows server dep… |
CVE-2020-12875 | Medium | 6.3 | 2020-05-14 | Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive informat… |
CVE-2020-1998 | Medium | 5.4 | 2020-05-13 | An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the acc… |
CVE-2020-8151 | High | 7.5 | 2020-05-12 | There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in… |
CVE-2020-12691 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that… |
CVE-2020-7921 | Medium | 4.6 | 2020-05-06 | Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to by… |
CVE-2020-4446 | Medium | 4.3 | 2020-05-06 | IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions… |
CVE-2020-2188 | Medium | 4.3 | 2020-05-06 | A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credenti… |
CVE-2020-5343 | High | 7.3 | 2020-05-04 | Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability… |
CVE-2020-5333 | Medium | 4.3 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user cou… |
CVE-2020-12477 | High | 7.5 | 2020-04-29 | The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HT… |
CVE-2020-10786 | High | 8.8 | 2020-04-21 | A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs. |
CVE-2020-11753 | High | 8.8 | 2020-04-20 | An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, mo… |
CVE-2020-5293 | Medium | 6.5 | 2020-04-20 | In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The… |
CVE-2020-5288 | Medium | 4.1 | 2020-04-20 | "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. |