CWE-863: Incorrect Authorization, page 89

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

1. 8.8CVE-2016-4572EPSS 0.9%2019-11-26

   In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

2. 6.5CVE-2016-3131EPSS 0.7%2019-11-26

   Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

3. 6.5CVE-2011-3617EPSS 1.1%2019-11-26

   Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.

4. 6.5CVE-2019-5879EPSS 0.6%2019-11-25

   Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.

5. 4.3CVE-2019-5864EPSS 0.5%2019-11-25

   Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.

6. 4.3CVE-2019-13716EPSS 0.9%2019-11-25

   Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

7. 6.5CVE-2015-1780EPSS 1.0%2019-11-22

   oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

8. 8.8CVE-2019-16538EPSS 1.4%2019-11-21

   A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

9. 7.5CVE-2012-2238EPSS 1.8%2019-11-21

   trytond 2.4: ModelView.button fails to validate authorization

10. 7.5CVE-2011-2726EPSS 1.6%2019-11-15

    An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file…

11. 7.5CVE-2019-18949EPSS 1.4%2019-11-14

    SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.

12. 7.8CVE-2011-1070EPSS 0.4%2019-11-14

    v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and potentially other consequences.

13. 4.6CVE-2019-5231EPSS 0.2%2019-11-13

    P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful …

14. 5.3CVE-2018-18819EPSS 1.4%2019-11-12

    A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 …

15. 4.3CVE-2019-4509EPSS 0.7%2019-11-09

    IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.

16. 9.8CVE-2019-12419EPSS 14%2019-11-06

    Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated p…

17. 9.1CVE-2010-2548EPSS 2.0%2019-10-31

    IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.

18. 5.3CVE-2018-21030EPSS 1.4%2019-10-31

    Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

19. 4.3CVE-2019-5533EPSS 17%2019-10-29

    In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is use…

20. 7.5CVE-2009-3723EPSS 1.2%2019-10-29

    asterisk allows calls on prohibited networks

21. 5.3CVE-2019-4311EPSS 1.2%2019-10-29

    IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 161037.

22. 6.5CVE-2019-6144EPSS 1.0%2019-10-23

    This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection.

23. 9.8CVE-2019-15900EPSS 2.1%2019-10-18

    An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in …

24. 7.5CVE-2019-14832EPSS 0.5%2019-10-15

    A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized inf…

25. 7.5CVE-2019-17191EPSS 1.8%2019-10-05

    The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the …

26. 3.3CVE-2019-9364EPSS 0.1%2019-09-27

    In AudioService, there is a possible trigger of background user audio due to a permissions bypass. This could lead to local information disclosure by playing the background user's audio with no additional execution privileges needed. User …

27. 5.5CVE-2019-9272EPSS 0.1%2019-09-27

    In WiFi, there is a possible leak of WiFi state due to a permissions bypass. This could lead to a local information disclosure which could be used to determine device location with no additional execution privileges needed. User interactio…

28. 7.8CVE-2019-12671EPSS 0.4%2019-09-25

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insuffici…

29. 9.8CVE-2019-15941EPSS 2.5%2019-09-25

    OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDA…

30. 8.8CVE-2019-12648EPSS 2.4%2019-09-25

    A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability i…

31. 7.5CVE-2019-16884EPSS 4.4%2019-09-25

    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /…

32. 5.3CVE-2016-10996EPSS 1.1%2019-09-20

    The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.

33. 6.5CVE-2019-6838EPSS 0.8%2019-09-17

    A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server …

34. 7.5CVE-2019-6836EPSS 1.3%2019-09-17

    A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server …

35. 7.5CVE-2019-15729EPSS 1.7%2019-09-17

    An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.

36. 9.8CVE-2019-14237EPSS 2.9%2019-09-12

    On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.

37. 9.8CVE-2019-14236EPSS 2.3%2019-09-12

    On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instru…

38. 5.5CVE-2019-1289EPSS 0.7%2019-09-11

    An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissions, aka 'Windows Update Delivery Optimization Elevation of Privilege Vulnerability'.

39. 5.3CVE-2019-14995EPSS 3.0%2019-09-11

    The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

40. 9.8CVE-2019-16114EPSS 4.8%2019-09-09

    In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads f…

41. 9.8CVE-2019-14813EPSS 11%2019-09-06

    A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could…

42. 7.8CVE-2019-2175EPSS 0.2%2019-09-05

    In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect order of arguments. This could lead to local escalation of privilege with no additional execution privileges needed. Use…

43. 7.8CVE-2019-14817EPSS 2.0%2019-09-03

    A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript fil…

44. 7.8CVE-2019-14811EPSS 3.7%2019-09-03

    A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file c…

45. 8.1CVE-2019-11247EPSS 2.1%2019-08-29

    The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role…

46. 5.3CVE-2019-8446ExploitEPSS 18%2019-08-23

    The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

47. 5.3CVE-2019-8445EPSS 2.7%2019-08-23

    Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.

48. 4.3CVE-2019-1192EPSS 3.7%2019-08-14

    A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability allows Microsoft browsers to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that…

49. 5.3CVE-2019-13417EPSS 1.1%2019-08-12

    Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.

50. 7.5CVE-2019-14924EPSS 2.0%2019-08-10

    An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessi…