CWE-285: Improper Authorization, page 35

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

1. 4.3CVE-2016-0373EPSS 0.8%2018-08-30

   IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.

2. 2.7CVE-2014-6049ExploitEPSS 3.2%2018-08-28

   phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.

3. 5.3CVE-2018-3778EPSS 1.4%2018-08-08

   Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.

4. 6.5CVE-2018-0391EPSS 2.7%2018-08-01

   A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a pass…

5. 6.5CVE-2018-12467EPSS 0.6%2018-08-01

   Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

6. 6.5CVE-2018-12466EPSS 0.8%2018-08-01

   openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

7. 4.9CVE-2017-2632EPSS 1.5%2018-07-27

   A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenan…

8. 9.0CVE-2017-2589EPSS 0.9%2018-07-26

   It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients usi…

9. 7.8CVE-2018-10906ExploitEPSS 1.4%2018-07-24

   In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether '…

10. 6.5CVE-2018-0393EPSS 0.9%2018-07-18

    A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficie…

11. 4.4CVE-2018-1116EPSS 1.2%2018-07-10

    A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes own…

12. 8.1CVE-2018-10861EPSS 3.2%2018-07-10

    A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are belie…

13. 8.8CVE-2017-16773EPSS 1.4%2018-07-05

    Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission checks for directories in POSIX mode.

14. 5.3CVE-2018-1113EPSS 0.3%2018-07-03

    setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's…

15. 9.1CVE-2017-16726EPSS 0.5%2018-06-27

    Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve security purposes and therefore does not include any encryption algorithms becaus…

16. 7.5CVE-2013-7245EPSS 1.4%2018-04-24

    The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859.

17. 8.1CVE-2018-1082EPSS 2.0%2018-04-04

    A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.

18. 6.5CVE-2017-0927EPSS 0.8%2018-03-21

    Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.

19. 8.8CVE-2017-0926EPSS 1.4%2018-03-21

    Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.

20. 4.3CVE-2015-7463EPSS 0.7%2018-03-15

    IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393.

21. 6.3CVE-2016-9575EPSS 0.8%2018-03-13

    Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw …

22. 6.5CVE-2017-9268EPSS 0.6%2018-03-01

    In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of…

23. 8.8CVE-2017-11398ExploitEPSS 8.2%2018-01-19

    A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a v…

24. 9.8CVE-2017-16743EPSS 3.1%2018-01-12

    An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing a…

25. 7.2CVE-2017-12160EPSS 1.9%2017-10-26

    It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already comp…

26. 7.5CVE-2017-1002151EPSS 1.1%2017-09-14

    Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization

27. 7.2CVE-2015-3656EPSS 1.1%2017-08-29

    Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.

28. 9.8CVE-2017-6044EPSS 4.3%2017-06-30

    An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files and directories can be accessed without authentication, whi…

29. 7.5CVE-2016-1000219EPSS 2.0%2017-06-16

    Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behin…

30. 7.8CVE-2014-9950EPSS 0.5%2017-06-06

    In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.

31. 7.8CVE-2014-9945EPSS 0.5%2017-06-06

    In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.

32. 6.5CVE-2017-0896EPSS 1.3%2017-06-02

    Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization e…

33. 7.5CVE-2017-7484EPSS 2.6%2017-05-12

    It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_st…

34. 3.5CVE-2017-0895EPSS 0.7%2017-05-08

    Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.

35. 4.3CVE-2017-0894EPSS 1.2%2017-05-08

    Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.

36. 3.5CVE-2017-0892EPSS 1.0%2017-05-08

    Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.

37. 5.3CVE-2016-5063ExploitEPSS 8.4%2017-05-02

    The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors.

38. 4.6CVE-2016-8776EPSS 0.4%2017-04-02

    Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection (FRP) to enter some functional modules without authorization…

39. 8.8CVE-2017-2689EPSS 1.4%2017-03-29

    Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged file system access or change configuration settings.

40. 6.5CVE-2017-2686EPSS 1.1%2017-03-29

    Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port 10000/TCP and access sensitive information.

41. 4.3CVE-2016-9464EPSS 1.6%2017-03-28

    Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group s…

42. 5.3CVE-2016-7651EPSS 0.3%2017-02-20

    An issue was discovered in certain Apple products. iOS before 10.2 is affected. watchOS before 3.1.1 is affected. The issue involves the "Accounts" component, which allows local users to bypass intended authorization restrictions by levera…

43. 7.8CVE-2016-8443EPSS 0.3%2017-01-12

    Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.18. Android ID: A-32576499. References: QC-CR#964185.

44. 8.8CVE-2016-9217EPSS 1.3%2016-12-26

    A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affect…

45. 5.3CVE-2016-9938EPSS 3.4%2016-12-12

    An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definitio…

46. 10.0CVE-2016-5788EPSS 2.3%2016-11-25

    General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.

47. 4.4CVE-2016-7097EPSS 0.4%2016-10-16

    The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute…

48. 7.5CVE-2015-1000007EPSS 2.3%2016-10-06

    Remote file download vulnerability in wptf-image-gallery v1.03

49. 8.1CVE-2016-7143EPSS 1.1%2016-09-21

    The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

50. 9.8CVE-2016-0922EPSS 1.5%2016-09-18

    EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.