CWE-863

A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s):

An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged appli

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control u

Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to acces

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in u

The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in us

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not c

In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-pro

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific requ

A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting ve

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETG

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.

Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had

An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with It

The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instan

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blo

AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open po

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes i

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctl

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypa

Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp

An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Cre

Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to a

The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Au

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP In

An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by fo

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX a

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow user

The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are avai

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other p

The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management.

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could

Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows att

Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect author