CWE-863 · Incorrect Authorization (page 42)
Page 42 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7512 | Critical | 9.8 | 2017-07-07 | Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could u… |
CVE-2017-10805 | High | 8.8 | 2017-07-04 | In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows… |
CVE-2017-8907 | High | 8.8 | 2017-06-14 | Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore t… |
CVE-2017-9378 | Medium | 6.5 | 2017-06-02 | BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an a… |
CVE-2017-2306 | High | 8.8 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web inte… |
CVE-2017-2305 | High | 8.8 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web inte… |
CVE-2017-7505 | High | 8.8 | 2017-05-26 | Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organiz… |
CVE-2017-4915 | High | 7.8 | 2017-05-22 | VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this iss… |
CVE-2017-0894 | Medium | 4.3 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potenti… |
CVE-2017-3817 | Medium | 4.3 | 2017-04-07 | A vulnerability in the role-based resource checking functionality of Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacke… |
CVE-2017-0881 | Medium | 4.3 | 2017-03-28 | An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an… |
CVE-2017-5618 | High | 7.8 | 2017-03-20 | GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissio… |
CVE-2017-6377 | High | 7.5 | 2017-03-16 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an… |
CVE-2017-6816 | Medium | 4.9 | 2017-03-12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. |
CVE-2017-6590 | Medium | 6.3 | 2017-03-09 | An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use… |
CVE-2017-3801 | High | 8.8 | 2017-02-15 | A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items… |
CVE-2016-4178 | Medium | 4.3 | 2016-07-13 | Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to bypass in… |
CVE-2016-4514 | High | 7.7 | 2016-06-19 | Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy. |
CVE-2015-4106 | | 2015-06-03 | QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privi… | |
CVE-2014-8109 | | 2014-12-29 | mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authoriz… | |
CVE-2014-3520 | | 2014-10-26 | OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unautho… | |
CVE-2013-6926 | | 2013-12-17 | The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on administrative actions… | |
CVE-2013-0543 | | 2013-04-24 | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when… | |
CVE-2013-0889 | | 2013-02-23 | Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before procee… | |
CVE-2012-1342 | Medium | 5.8 | 2012-08-06 | Cisco Carrier Routing System (CRS) 3.9, 4.0, and 4.1 allows remote attackers to bypass ACL entries via fragmented packets, aka Bug ID CSCtj10975. |
CVE-2011-1207 | | 2011-05-05 | The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2… | |
CVE-2011-1123 | | 2011-03-01 | Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors. | |
CVE-2010-4296 | | 2010-12-06 | vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux… | |
CVE-2010-2965 | Critical | 9.8 | 2010-08-05 | The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3… |
CVE-2008-7109 | Critical | 9.8 | 2009-08-28 | The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to bypass authorization and upload arbitrary files to the client s… |
CVE-2009-2213 | Medium | 6.5 | 2009-06-25 | The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earli… |
CVE-2008-6123 | | 2009-02-12 | The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not proper… | |
CVE-2009-0034 | High | 7.8 | 2009-01-30 | parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user… |
CVE-2008-4577 | High | 7.5 | 2008-10-15 | The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access re… |
CVE-2008-3424 | | 2008-07-31 | Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorizat… | |
CVE-2008-0595 | | 2008-02-29 | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qual… | |
CVE-2007-3968 | Medium | 5.3 | 2007-07-25 | index.php in dirLIST before 0.1.1 allows remote attackers to list the contents of an excluded folder via a modified URL containing the folder name. |
CVE-2007-2586 | | 2007-05-10 | The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have oth… | |
CVE-2006-6679 | High | 7.5 | 2006-12-21 | Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote at… |
CVE-2005-2136 | | 2005-07-05 | Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permi… | |
CVE-2001-1155 | Critical | 9.8 | 2001-08-23 | TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which… |