CWE-863: Incorrect Authorization, page 83

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

1. 5.4CVE-2021-31552EPSS 0.6%2021-04-22

   An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while bloc…

2. 6.5CVE-2021-31548EPSS 0.7%2021-04-22

   An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.

3. 9.8CVE-2021-28793EPSS 1.6%2021-04-20

   vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.

4. 7.8CVE-2021-3493KEVExploitEPSS 49%2021-04-17

   The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along…

5. 6.5CVE-2021-29452EPSS 0.8%2021-04-16

   a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were …

6. 7.8CVE-2021-28826EPSS 0.2%2021-04-14

   The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnera…

7. 7.8CVE-2021-28825EPSS 0.2%2021-04-14

   The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerabili…

8. 7.2CVE-2021-29439EPSS 2.6%2021-04-13

   The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin,…

9. 6.8CVE-2021-29437EPSS 0.9%2021-04-13

   ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user…

10. 7.8CVE-2021-27086EPSS 0.8%2021-04-13

    Windows Services and Controller App Elevation of Privilege Vulnerability

11. 9.1CVE-2021-29943EPSS 4.7%2021-04-13

    When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorre…

12. 7.5CVE-2019-15059EPSS 1.1%2021-04-12

    In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX info…

13. 9.8CVE-2020-28872EPSS 3.3%2021-04-12

    An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid credentials.

14. 8.8CVE-2021-25356EPSS 0.2%2021-04-09

    An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application.

15. 5.3CVE-2020-36287EPSS 9.0%2021-04-09

    The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget rela…

16. 5.5CVE-2020-14106EPSS 0.7%2021-04-08

    The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.

17. 4.3CVE-2021-24207EPSS 0.7%2021-04-05

    By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.

18. 6.3CVE-2020-27901EPSS 0.6%2021-04-02

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. A sandboxed process may be able to circumvent sand…

19. 5.5CVE-2021-26718EPSS 0.2%2021-04-01

    KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.

20. 5.3CVE-2020-36238EPSS 1.6%2021-04-01

    The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is…

21. 5.3CVE-2021-29642EPSS 0.9%2021-03-30

    GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens.

22. 7.5CVE-2021-28936EPSS 2.0%2021-03-29

    The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known (default:admin) whereas no previous au…

23. 5.5CVE-2021-21411EPSS 1.1%2021-03-26

    OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardl…

24. 8.8CVE-2021-21389ExploitEPSS 15%2021-03-26

    BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST A…

25. 5.9CVE-2021-27195EPSS 0.8%2021-03-25

    Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic.

26. 4.9CVE-2021-22186EPSS 0.9%2021-03-24

    An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

27. 4.3CVE-2021-22176EPSS 1.0%2021-03-24

    An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

28. 8.8CVE-2021-28824EPSS 0.2%2021-03-23

    The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a lo…

29. 7.8CVE-2021-28823EPSS 0.2%2021-03-23

    The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker wi…

30. 7.8CVE-2021-28821EPSS 0.2%2021-03-23

    The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theo…

31. 7.8CVE-2021-28819EPSS 0.2%2021-03-23

    The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with …

32. 6.5CVE-2021-28146EPSS 1.4%2021-03-22

    The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups t…

33. 7.8CVE-2021-28791EPSS 1.6%2021-03-18

    The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution up…

34. 4.3CVE-2021-21624EPSS 0.9%2021-03-18

    An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

35. 6.5CVE-2021-21623EPSS 1.0%2021-03-18

    An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

36. 5.3CVE-2021-28681EPSS 0.7%2021-03-18

    Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC impleme…

37. 4.3CVE-2021-20676EPSS 0.8%2021-03-18

    M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) versions prior to Ver3.0, type D (DL8-D) versions prior to Ver3.0, and type E (DL8-E) versions prior to Ver3.0) allows re…

38. 9.8CVE-2020-24264EPSS 4.1%2021-03-16

    Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to sp…

39. 4.3CVE-2021-20283EPSS 1.1%2021-03-15

    The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

40. 5.3CVE-2021-20282EPSS 1.3%2021-03-15

    When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

41. 5.3CVE-2021-20281EPSS 1.4%2021-03-15

    It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

42. 8.8CVE-2020-25240EPSS 0.9%2021-03-15

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An attacker could impact availability, integrity and gain information from logs and t…

43. 8.8CVE-2020-25239EPSS 1.0%2021-03-15

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for unpriviledged users. The settings of the UMC authorization server could be chang…

44. 8.1CVE-2021-20179EPSS 1.2%2021-03-15

    A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerab…

45. 7.5CVE-2021-28373EPSS 0.9%2021-03-13

    The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users …

46. 8.8CVE-2020-35682EPSS 7.2%2021-03-13

    Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

47. 8.1CVE-2021-21367EPSS 0.6%2021-03-12

    Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairin…

48. 5.5CVE-2021-0382EPSS 0.1%2021-03-10

    In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local information disclosure with no additional execution privileges needed. User interacti…

49. 7.8CVE-2021-0376EPSS 0.1%2021-03-10

    In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges neede…

50. 4.3CVE-2021-21186EPSS 1.1%2021-03-09

    Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.