CWE-863

SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended J

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File uploa

trytond 2.4: ModelView.button fails to validate authorization

ReviewBoard: has an access-control problem in REST API

Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All ver

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood gluc

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modif

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t

An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configu

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, whic

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows

To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users

A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of req

Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creati

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL

Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unath

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-

This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08

oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a

Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.

Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass S

IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabil

Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been

This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtua

An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce f

In WiFi, there is a possible leak of WiFi state due to a permissions bypass. This could lead to a local information disc

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filenam

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and fr

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fie

Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote a

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an atta

The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The info

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, f

A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo

There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerabilit

An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with