CWE-863 · Incorrect Authorization (page 41)
Page 41 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9488 | High | 7.8 | 2018-11-06 | In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, wi… |
CVE-2018-14665 | Medium | 6.6 | 2018-10-25 | A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unpri… |
CVE-2018-12369 | Critical | 9.8 | 2018-10-18 | WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser… |
CVE-2018-17857 | Medium | 4.3 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation. |
CVE-2018-1000805 | High | 8.8 | 2018-10-08 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This… |
CVE-2018-15405 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an… |
CVE-2018-0460 | Medium | 6.5 | 2018-10-05 | A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an af… |
CVE-2018-0459 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to… |
CVE-2018-9492 | High | 7.8 | 2018-10-02 | In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with… |
CVE-2018-1250 | Medium | 6.5 | 2018-09-28 | Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially ex… |
CVE-2018-16597 | Medium | 5.5 | 2018-09-21 | An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate fi… |
CVE-2018-7929 | Medium | 6.8 | 2018-09-18 | Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. An attacker could unlock and use the pho… |
CVE-2018-1999047 | Medium | 6.5 | 2018-08-23 | A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins… |
CVE-2018-15468 | Medium | 6.0 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In part… |
CVE-2018-10925 | High | 8.1 | 2018-08-09 | It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involve… |
CVE-2018-3778 | Medium | 5.3 | 2018-08-08 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. |
CVE-2018-5489 | Medium | 6.5 | 2018-08-03 | NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administ… |
CVE-2018-7957 | Low | 3.3 | 2018-07-31 | Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization co… |
CVE-2017-17708 | Medium | 4.3 | 2018-07-31 | Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before… |
CVE-2017-2632 | Medium | 4.9 | 2018-07-27 | A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level th… |
CVE-2017-7470 | Medium | 6.5 | 2018-07-27 | It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check i… |
CVE-2018-11047 | High | 7.5 | 2018-07-24 | Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly a… |
CVE-2017-3183 | High | 8.8 | 2018-07-24 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to pr… |
CVE-2018-1999004 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read p… |
CVE-2018-1999003 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permissio… |
CVE-2017-2673 | Medium | 6.8 | 2018-07-19 | An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could req… |
CVE-2018-1245 | Critical | 9.0 | 2018-07-13 | RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (A… |
CVE-2018-13109 | High | 7.5 | 2018-07-06 | All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access a… |
CVE-2018-12103 | Medium | 6.5 | 2018-07-05 | An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with fir… |
CVE-2017-16773 | Medium | 6.5 | 2018-07-05 | Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission… |
CVE-2018-0337 | High | 7.8 | 2018-06-21 | A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2018-8927 | Medium | 5.4 | 2018-06-14 | Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) c… |
CVE-2017-15695 | High | 8.8 | 2018-06-13 | When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invok… |
CVE-2018-0338 | High | 7.8 | 2018-06-07 | A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to e… |
CVE-2018-1000197 | High | 8.1 | 2018-06-05 | An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/… |
CVE-2018-11142 | Medium | 5.5 | 2018-05-31 | The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from… |
CVE-2018-1000155 | Critical | 9.8 | 2018-05-24 | OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath IDentifier) in the… |
CVE-2018-1463 | Medium | 6.5 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1462 | High | 7.6 | 2018-05-17 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7… |
CVE-2018-1278 | Medium | 6.5 | 2018-05-11 | Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorizati… |
CVE-2018-1258 | High | 8.8 | 2018-05-11 | Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An un… |
CVE-2017-2611 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /f… |
CVE-2018-0278 | Medium | 6.5 | 2018-05-02 | A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the… |
CVE-2018-5520 | Medium | 4.4 | 2018-05-02 | On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative use… |
CVE-2018-10212 | Medium | 5.4 | 2018-04-25 | An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creation of folders within another account via… |
CVE-2017-1700 | Medium | 6.5 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2018-0269 | Medium | 4.3 | 2018-04-19 | A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communica… |
CVE-2018-7245 | Critical | 9.1 | 2018-04-18 | An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integ… |
CVE-2017-12196 | Medium | 4.8 | 2018-04-18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value… |
CVE-2017-2599 | Medium | 5.4 | 2018-04-11 | Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) t… |
CVE-2018-1000152 | Medium | 6.3 | 2018-04-05 | An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, Con… |
CVE-2017-1766 | Medium | 4.3 | 2018-03-30 | Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151. |
CVE-2017-0920 | Medium | 4.3 | 2018-03-22 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::Crea… |
CVE-2017-0927 | Medium | 6.5 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deploy… |
CVE-2017-0926 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. |
CVE-2017-0922 | High | 7.5 | 2018-03-21 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an inform… |
CVE-2017-17668 | High | 7.5 | 2018-03-20 | Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the… |
CVE-2018-1057 | High | 8.8 | 2018-03-13 | On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authent… |
CVE-2018-1000114 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attac… |
CVE-2018-1000112 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network… |
CVE-2018-1000111 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus… |
CVE-2018-1000110 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to… |
CVE-2018-1000109 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java th… |
CVE-2018-1000107 | Medium | 6.5 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.ja… |
CVE-2018-1000106 | Medium | 5.4 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl… |
CVE-2018-1000105 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl… |
CVE-2016-9575 | Medium | 6.3 | 2018-03-13 | Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certp… |
CVE-2017-17323 | Medium | 4.3 | 2018-03-09 | Huawei iBMC V200R002C10; V200R002C20; V200R002C30 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a… |
CVE-2017-18095 | Medium | 5.3 | 2018-02-19 | The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on sni… |
CVE-2018-6316 | High | 7.5 | 2018-02-15 | Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and a… |
CVE-2017-1233 | Medium | 6.7 | 2018-01-31 | IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he can cause to be execut… |
CVE-2017-16858 | Medium | 6.8 | 2018-01-31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker t… |
CVE-2017-15091 | High | 7.1 | 2018-01-23 | An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations… |
CVE-2017-12118 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An a… |
CVE-2017-12116 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768… |
CVE-2017-12113 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768)… |
CVE-2017-12117 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A J… |
CVE-2017-12115 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c07376… |
CVE-2017-12114 | Medium | 6.8 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A J… |
CVE-2017-12112 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A… |
CVE-2017-12197 | Medium | 6.5 | 2018-01-18 | It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled acc… |
CVE-2018-0110 | High | 8.1 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even after it has been disabl… |
CVE-2018-0096 | Medium | 5.9 | 2018-01-18 | A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a… |
CVE-2017-16743 | Critical | 9.8 | 2018-01-12 | An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remot… |
CVE-2018-2361 | High | 8.8 | 2018-01-09 | In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for confi… |
CVE-2017-4946 | High | 7.8 | 2018-01-05 | The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability. Successful exploitation of this issue could result in a… |
CVE-2018-0803 | Medium | 4.2 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to access information from one domain and injec… |
CVE-2017-17067 | Critical | 9.8 | 2017-11-30 | Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML auth… |
CVE-2017-1628 | Medium | 6.5 | 2017-11-27 | IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks. |
CVE-2017-0910 | High | 8.8 | 2017-11-27 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server cre… |
CVE-2017-8216 | Medium | 5.5 | 2017-11-22 | Warsaw Huawei Smart phones with software of versions earlier than Warsaw-AL00C00B180, versions earlier than Warsaw-TL10C01B180 have a permission control vulner… |
CVE-2017-8196 | Medium | 4.2 | 2017-11-22 | FusionSphere V100R006C00SPC102(NFV) has an incorrect authorization vulnerability. An authenticated attacker could execute commands that he/she should have had… |
CVE-2017-8192 | High | 7.8 | 2017-11-22 | FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this… |
CVE-2017-3891 | Critical | 9.6 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enab… |
CVE-2017-12261 | High | 7.8 | 2017-11-02 | A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to… |
CVE-2017-5060 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote a… |
CVE-2017-10379 | Medium | 6.5 | 2017-10-19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.3… |
CVE-2017-9653 | Critical | 9.8 | 2017-08-14 | An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2… |
CVE-2016-6797 | High | 7.5 | 2017-08-10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not… |
CVE-2017-8633 | High | 7.5 | 2017-08-08 | Windows Error Reporting (WER) in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Go… |