CWE-863 · Incorrect Authorization (page 39)
Page 39 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5287 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. |
CVE-2020-5279 | Medium | 4.1 | 2020-04-20 | In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.p… |
CVE-2020-0981 | High | 8.8 | 2020-04-15 | A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploited the vulnerabili… |
CVE-2020-6214 | Medium | 4.7 | 2020-04-14 | SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected wi… |
CVE-2020-11707 | High | 8.8 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. It doesn't enforce permission over Windows Symlinks or Junctions. As a result, a low-pri… |
CVE-2018-21039 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0) software. With the Location permission for the compass feature in Quick Tools (aka QuickTools), a… |
CVE-2018-21082 | High | 8.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. Dex Station allows App Pinning bypass and lock-screen bypass via the "Use screen lock t… |
CVE-2020-11628 | Medium | 5.3 | 2020-04-08 | An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols (CMP, ACME, REST… |
CVE-2020-8142 | Medium | 6.8 | 2020-04-03 | A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many othe… |
CVE-2018-11802 | Medium | 4.3 | 2020-04-01 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node rece… |
CVE-2020-5275 | High | 7.6 | 2020-03-30 | In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as so… |
CVE-2020-10510 | High | 8.1 | 2020-03-27 | Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific U… |
CVE-2020-1796 | Medium | 6.6 | 2020-03-20 | There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit… |
CVE-2019-11361 | High | 8.8 | 2020-03-19 | Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application… |
CVE-2020-10239 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. |
CVE-2020-5240 | High | 7.6 | 2020-03-13 | In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not requir… |
CVE-2020-10534 | Critical | 9.8 | 2020-03-12 | In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining es… |
CVE-2020-0087 | Medium | 5.5 | 2020-03-10 | In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure. This could lead to local information disclosure with… |
CVE-2020-0036 | High | 7.8 | 2020-03-10 | In hasPermissions of PermissionMonitor.java, there is a possible access to restricted permissions due to a permissions bypass. This could lead to local escalat… |
CVE-2019-13001 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue tha… |
CVE-2020-2148 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2020-2135 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterc… |
CVE-2020-2134 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies. |
CVE-2020-5251 | High | 7.7 | 2020-03-04 | In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionT… |
CVE-2020-9381 | High | 7.5 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in c… |
CVE-2019-4745 | Medium | 4.3 | 2020-02-24 | IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information… |
CVE-2014-7914 | High | 8.1 | 2020-02-21 | btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to… |
CVE-2020-5242 | High | 7.7 | 2020-02-20 | openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the… |
CVE-2013-4228 | Medium | 4.3 | 2020-02-18 | The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to pr… |
CVE-2020-7251 | Medium | 5.0 | 2020-02-14 | Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to… |
CVE-2020-5239 | High | 8.7 | 2020-02-13 | In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu server… |
CVE-2020-6380 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2020-5318 | High | 7.5 | 2020-02-06 | Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability… |
CVE-2020-8119 | Medium | 4.3 | 2020-02-04 | Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. |
CVE-2013-2673 | Medium | 6.8 | 2020-02-03 | Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access. |
CVE-2020-7955 | Medium | 5.3 | 2020-01-31 | HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended informati… |
CVE-2013-2198 | Critical | 9.8 | 2020-01-30 | The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username. |
CVE-2013-1350 | Critical | 9.1 | 2020-01-30 | Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities |
CVE-2013-2574 | High | 7.5 | 2020-01-29 | An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malic… |
CVE-2020-2104 | Medium | 4.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. |
CVE-2020-8086 | Critical | 9.8 | 2020-01-28 | The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. T… |
CVE-2013-4862 | High | 8.1 | 2020-01-28 | MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squash… |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2019-17190 | High | 7.8 | 2020-01-27 | A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpd… |
CVE-2020-2097 | High | 8.8 | 2020-01-15 | Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to exe… |
CVE-2020-6307 | Medium | 4.3 | 2020-01-14 | Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization… |
CVE-2012-3821 | Medium | 4.3 | 2020-01-10 | A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify… |
CVE-2012-3822 | High | 7.5 | 2020-01-10 | Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials. |
CVE-2019-17014 | High | 7.4 | 2020-01-08 | If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin info… |
CVE-2016-6591 | High | 7.1 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let a local malicious u… |
CVE-2019-14843 | High | 8.8 | 2020-01-07 | A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app… |
CVE-2019-6855 | High | 7.3 | 2020-01-06 | Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all ve… |
CVE-2014-0169 | Medium | 6.5 | 2020-01-02 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an auth… |
CVE-2010-3782 | High | 8.8 | 2020-01-02 | obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation. |
CVE-2019-20213 | High | 7.5 | 2020-01-02 | D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. |
CVE-2019-12837 | Medium | 4.3 | 2019-12-31 | The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints. |
CVE-2018-20498 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20494 | High | 7.5 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20493 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-4343 | Medium | 6.5 | 2019-12-30 | IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An att… |
CVE-2013-4985 | High | 7.5 | 2019-12-27 | Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream |
CVE-2018-20492 | Medium | 5.3 | 2019-12-26 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-19681 | High | 8.8 | 2019-12-26 | Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and exec… |
CVE-2019-19984 | Medium | 6.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and ema… |
CVE-2017-16778 | Medium | 4.6 | 2019-12-24 | An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to inv… |
CVE-2012-6094 | Critical | 9.8 | 2019-12-20 | cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system |
CVE-2019-11294 | Medium | 4.3 | 2019-12-19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs… |
CVE-2019-8512 | Medium | 5.7 | 2019-12-18 | This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their d… |
CVE-2019-0384 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0383 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-7192 | Critical | 9.8 | 2019-12-05 | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend upda… |
CVE-2019-19597 | High | 8.8 | 2019-12-05 | D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH… |
CVE-2019-19520 | High | 7.8 | 2019-12-05 | xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/m… |
CVE-2013-4411 | Medium | 4.3 | 2019-12-03 | Review Board: URL processing gives unauthorized users access to review lists |
CVE-2013-4410 | High | 7.5 | 2019-12-02 | ReviewBoard: has an access-control problem in REST API |
CVE-2016-6353 | Medium | 6.5 | 2019-11-26 | Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the R… |
CVE-2016-4572 | High | 8.8 | 2019-11-26 | In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges. |
CVE-2016-3131 | Medium | 6.5 | 2019-11-26 | Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls. |
CVE-2011-3617 | Medium | 6.5 | 2019-11-26 | Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. |
CVE-2019-5879 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2019-5864 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass… |
CVE-2019-13716 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2019-16538 | High | 8.8 | 2019-11-21 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed… |
CVE-2012-2238 | High | 7.5 | 2019-11-21 | trytond 2.4: ModelView.button fails to validate authorization |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2019-18949 | High | 7.5 | 2019-11-14 | SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webp… |
CVE-2011-1070 | High | 7.8 | 2019-11-14 | v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and pote… |
CVE-2019-5231 | Medium | 4.6 | 2019-11-13 | P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an… |
CVE-2018-18819 | Medium | 5.3 | 2019-11-12 | A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202)… |
CVE-2019-4509 | Medium | 4.3 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive infor… |
CVE-2019-12419 | Critical | 9.8 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability i… |
CVE-2010-2548 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. |
CVE-2018-21030 | Medium | 5.3 | 2019-10-31 | Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be place… |
CVE-2019-5533 | Medium | 4.3 | 2019-10-29 | In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtai… |
CVE-2009-3723 | High | 7.5 | 2019-10-29 | asterisk allows calls on prohibited networks |
CVE-2019-4311 | Medium | 5.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further at… |
CVE-2019-6144 | Medium | 6.5 | 2019-10-23 | This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection. |
CVE-2019-15900 | Critical | 9.8 | 2019-10-18 | An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking… |
CVE-2019-14832 | High | 7.5 | 2019-10-15 | A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated att… |