CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-284

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1020017 284 2019-07-29 2019-10-09
5.0
 None Remote Low Not required None Partial None
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.
2 CVE-2019-1010316 284 2019-07-11 2019-07-14
4.6
 None Local Low Not required Partial Partial Partial
pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is: 0.4.
3 CVE-2019-1010308 284 2019-07-15 2019-07-22
5.0
 None Remote Low Not required Partial None None
Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.
4 CVE-2019-1010304 284 2019-07-15 2019-07-30
5.0
 None Remote Low Not required Partial None None
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
5 CVE-2019-1010302 284 DoS 2019-07-15 2019-08-13
4.3
 None Remote Medium Not required None None Partial
jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file.
6 CVE-2019-1010263 284 Bypass 2019-07-17 2019-07-28
7.5
 None Remote Low Not required Partial Partial Partial
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
7 CVE-2019-1010260 284 Exec Code 2019-04-02 2019-04-04
9.3
 None Remote Medium Not required Complete Complete Complete
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
8 CVE-2019-1010221 284 2019-07-23 2019-08-02
4.4
 None Local Medium Not required Partial Partial Partial
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
9 CVE-2019-1010178 284 Exec Code 2019-07-24 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246.
10 CVE-2019-1010161 284 Bypass 2019-07-25 2019-08-02
7.5
 None Remote Low Not required Partial Partial Partial
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
11 CVE-2019-1010151 284 2019-07-19 2019-07-29
7.5
 None Remote Low Not required Partial Partial Partial
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
12 CVE-2019-1010136 284 2019-07-19 2019-07-24
7.8
 None Remote Low Not required None None Complete
ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only authenticaed users. The attack vector is: Remote.
13 CVE-2019-1010084 284 2019-07-17 2019-07-23
4.0
 None Remote Low Single system Partial None None
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.
14 CVE-2019-1010069 284 DoS 2019-07-18 2019-07-19
4.3
 None Remote Medium Not required None None Partial
moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.
15 CVE-2019-1010066 284 2019-07-18 2019-07-25
5.0
 None Remote Low Not required None Partial None
Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking, in order to write to model specific registers, normally a function reserved for the root user. The fixed version is: v1.2.0.
16 CVE-2019-1003006 284 Exec Code Bypass 2019-02-06 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
17 CVE-2019-1000021 284 2019-02-04 2019-09-02
5.0
 None Remote Low Not required Partial None None
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
18 CVE-2019-16114 284 Exec Code 2019-09-09 2019-09-10
7.5
 None Remote Low Not required Partial Partial Partial
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php.
19 CVE-2019-15895 284 2019-09-09 2019-09-09
5.0
 None Remote Low Not required None Partial None
search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
20 CVE-2019-15718 284 2019-09-04 2019-09-19
2.1
 None Local Low Not required None Partial None
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
21 CVE-2019-15648 284 2019-08-27 2019-08-29
5.5
 None Remote Low Single system None Partial Partial
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
22 CVE-2019-15493 284 2019-08-23 2019-08-26
6.4
 None Remote Low Not required None Partial Partial
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
23 CVE-2019-15137 284 2019-08-18 2019-08-29
5.0
 None Remote Low Not required None Partial None
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.
24 CVE-2019-15043 284 DoS 2019-09-03 2019-09-08
5.0
 None Remote Low Not required None None Partial
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
25 CVE-2019-15028 284 2019-08-14 2019-08-27
5.0
 None Remote Low Not required None Partial None
In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.
26 CVE-2019-14793 284 2019-08-09 2019-08-14
5.5
 None Remote Low Single system None Partial Partial
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
27 CVE-2019-14705 284 2019-08-06 2019-08-14
6.5
 None Remote Low Single system Partial Partial Partial
An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make requests as an admin.
28 CVE-2019-14397 284 2019-07-30 2019-07-31
5.0
 None Remote Low Not required None Partial None
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
29 CVE-2019-13656 284 Exec Code 2019-09-06 2019-09-09
7.5
 None Remote Low Not required Partial Partial Partial
An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.
30 CVE-2019-13450 284 2019-07-09 2019-07-16
4.3
 None Remote Medium Not required Partial None None
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
31 CVE-2019-13406 284 2019-08-28 2019-09-03
5.0
 None Remote Low Not required None Partial None
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
32 CVE-2019-13405 284 2019-08-28 2019-09-05
10.0
 None Remote Low Not required Complete Complete Complete
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
33 CVE-2019-13404 284 2019-07-07 2019-07-15
9.3
 None Remote Medium Not required Complete Complete Complete
** DISPUTED ** The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x.
34 CVE-2019-13403 284 2019-07-17 2019-07-18
5.0
 None Remote Low Not required Partial None None
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
35 CVE-2019-13294 284 Exec Code 2019-07-04 2019-07-10
10.0
 None Remote Low Not required Complete Complete Complete
AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.
36 CVE-2019-13271 284 2019-08-27 2019-09-03
5.8
 None Local Network Low Not required Partial Partial Partial
Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
37 CVE-2019-13265 284 2019-08-27 2019-09-03
5.8
 None Local Network Low Not required Partial Partial Partial
D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
38 CVE-2019-13264 284 2019-08-27 2019-09-03
5.8
 None Local Network Low Not required Partial Partial Partial
D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
39 CVE-2019-13188 284 Bypass 2019-09-05 2019-09-05
5.0
 None Remote Low Not required Partial None None
In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.
40 CVE-2019-13030 284 2019-08-14 2019-08-28
6.4
 None Remote Low Not required Partial None Partial
eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.
41 CVE-2019-13028 284 Exec Code 2019-06-28 2019-07-05
6.8
 None Remote Medium Not required Partial Partial Partial
An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the Slovak Republic.
42 CVE-2019-12926 284 2019-07-08 2019-07-16
6.5
 None Remote Low Single system Partial Partial Partial
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas within the application for which the accounts used were supposed to have insufficient access.
43 CVE-2019-12897 284 2019-06-19 2019-06-21
5.0
 None Remote Low Not required None None Partial
Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074.
44 CVE-2019-12894 284 2019-06-19 2019-06-21
5.0
 None Remote Low Not required None None Partial
Alternate Pic View 2.600 has a Read Access Violation at the Instruction Pointer after a call from PicViewer!PerfgrapFinalize+0x00000000000a9a1b.
45 CVE-2019-12887 284 2019-06-27 2019-07-01
6.8
 None Remote Medium Not required Partial Partial Partial
KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).
46 CVE-2019-12821 284 2019-07-19 2019-08-02
5.8
 None Remote Medium Not required None Partial Partial
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.
47 CVE-2019-12815 284 Exec Code 2019-07-19 2019-07-23
7.5
 None Remote Low Not required Partial Partial Partial
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
48 CVE-2019-12775 284 2019-06-07 2019-06-10
9.0
 None Remote Low Single system Complete Complete Complete
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.)
49 CVE-2019-12764 284 2019-06-11 2019-06-12
4.0
 None Remote Low Single system None Partial None
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
50 CVE-2019-12627 284 2019-08-21 2019-10-09
5.0
 None Remote Low Not required Partial None None
A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to insufficient application identification. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain unauthorized read access to sensitive data.
Total number of vulnerabilities : 1627   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.