Unauthenticated/Unauthorized Access - 15326 CVEs (Page 88/128)

About “Unauthenticated/Unauthorized Access”

A curated feed of “Unauthenticated/Unauthorized Access”-related CVEs appears below. We currently track 15326 CVEs for this tag (all time). In the last 365 days, 3832 were published. Average CVSS is 7.4 (all time; 7.4 over 365d), and 61% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-862 - Missing Authorization, CWE-306 - Missing Authentication for Critical Function, CWE-639 - Authorization Bypass Through User-Controlled Key.

In our taxonomy this topic maps to a HIGH impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2020-11-02

Medium

CVE-2020-28002

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allo…

CVSS: 5.3 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2020-14750

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.…

CVSS: 9.8 CWE: N/A View on NVD

2020-10-29

Critical

CVE-2020-27886

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available funct…

CVSS: 9.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2020-10-28

High

CVE-2020-27978

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in…

CVSS: 7.5 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

2020-10-26

Critical

CVE-2020-26879

Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorizat…

CVSS: 9.8 CWE: CWE-798 - Use of Hard-coded Credentials View on NVD

Critical

CVE-2020-7197

SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the mana…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2020-7124

A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.

CVSS: 9.8 CWE: N/A View on NVD

2020-10-23

Medium

CVE-2020-24847

A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to…

CVSS: 4.3 CWE: CWE-352 - Cross-Site Request Forgery (CSRF) View on NVD

2020-10-21

High

CVE-2020-3410

A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and…

CVSS: 8.1 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2020-15240

omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can al…

CVSS: 7.4 CWE: CWE-287 - Improper Authentication View on NVD

Medium

CVE-2020-14901

Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Analyze…

CVSS: 4.9 CWE: N/A View on NVD

Medium

CVE-2020-14897

Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login). Supported versions that are affected are 12.0.1, 12.0.2 and 12.0.3. Easil…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14896

Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 14.1.0-14.4.0. Easily exploitable vulnerabil…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14894

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily ex…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14890

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high p…

CVSS: 6.0 CWE: N/A View on NVD

Medium

CVE-2020-14887

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14886

CVSS: 6.0 CWE: N/A View on NVD

Medium

CVE-2020-14885

CVSS: 6.0 CWE: N/A View on NVD

Medium

CVE-2020-14884

CVSS: 6.0 CWE: N/A View on NVD

Critical

CVE-2020-14882

CVSS: 9.8 CWE: N/A View on NVD

Medium

CVE-2020-14881

CVSS: 6.0 CWE: N/A View on NVD

High

CVE-2020-14880

Vulnerability in the BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. E…

CVSS: 8.5 CWE: N/A View on NVD

High

CVE-2020-14879

CVSS: 8.5 CWE: N/A View on NVD

Medium

CVE-2020-14877

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Logging). Supported versions that are affected are 5.5 and 5.6. Easily exploit…

CVSS: 6.5 CWE: N/A View on NVD

Critical

CVE-2020-14876

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily expl…

CVSS: 9.1 CWE: N/A View on NVD

Critical

CVE-2020-14875

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily e…

CVSS: 9.1 CWE: N/A View on NVD

Critical

CVE-2020-14871

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows…

CVSS: 10.0 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2020-14865

Vulnerability in the PeopleSoft Enterprise SCM eSupplier Connection product of Oracle PeopleSoft (component: eSupplier Connection). The supported version that is affected is 9.2. Easily exploitable v…

CVSS: 8.1 CWE: N/A View on NVD

High

CVE-2020-14864

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and…

CVSS: 7.5 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

High

CVE-2020-14863

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are affected are 12.1.1 - 12.1.3. Easily exploitable vulnerabi…

CVSS: 8.2 CWE: N/A View on NVD

Critical

CVE-2020-14859

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2020-14857

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14856

CVSS: 8.2 CWE: N/A View on NVD

Critical

CVE-2020-14855

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable vul…

CVSS: 9.8 CWE: N/A View on NVD

Medium

CVE-2020-14854

Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: UI and Visualization). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerabil…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2020-14851

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14850

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Flex Fields). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploita…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14849

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14843

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0…

CVSS: 7.1 CWE: N/A View on NVD

High

CVE-2020-14842

Vulnerability in the BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Ea…

CVSS: 8.2 CWE: N/A View on NVD

Critical

CVE-2020-14841

CVSS: 9.8 CWE: N/A View on NVD

Medium

CVE-2020-14840

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploi…

CVSS: 4.7 CWE: N/A View on NVD

High

CVE-2020-14835

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1 - 12.1.3. Easily exploitable vulnerabil…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14834

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14833

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14832

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable v…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2020-14831

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14827

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14826

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: SQL Extensions). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploitab…

CVSS: 5.3 CWE: N/A View on NVD

Critical

CVE-2020-14825

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable v…

CVSS: 9.8 CWE: N/A View on NVD

High

CVE-2020-14824

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affect…

CVSS: 8.6 CWE: N/A View on NVD

Medium

CVE-2020-14823

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.3 - 12.2.10. Easily exploitable vulnera…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14822

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vuln…

CVSS: 4.7 CWE: N/A View on NVD

High

CVE-2020-14820

CVSS: 7.5 CWE: N/A View on NVD

High

CVE-2020-14819

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). The supported version that is affected is 12.1.3. Easily exploitable vulnerability all…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14817

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14816

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14815

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14813

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Grids). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerabil…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2020-14811

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: AMP EBS Integration). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily expl…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-14810

Vulnerability in the Oracle Hospitality Suite8 product of Oracle Hospitality Applications (component: WebConnect). Supported versions that are affected are 8.10.2 and 8.11-8.14. Easily exploitable vu…

CVSS: 5.4 CWE: N/A View on NVD

High

CVE-2020-14808

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable v…

CVSS: 8.2 CWE: N/A View on NVD

High

CVE-2020-14807

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2020-14806

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability…

CVSS: 5.3 CWE: N/A View on NVD

Critical

CVE-2020-14805

Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.1.3 and 12…

CVSS: 9.1 CWE: N/A View on NVD

Medium

CVE-2020-14803

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated…

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-14802

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable…

CVSS: 6.1 CWE: N/A View on NVD

Medium

CVE-2020-14801

CVSS: 6.1 CWE: N/A View on NVD

Low

CVE-2020-14798

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261…

CVSS: 3.1 CWE: N/A View on NVD

Low

CVE-2020-14797

CVSS: 3.7 CWE: N/A View on NVD

Low

CVE-2020-14796

CVSS: 3.1 CWE: N/A View on NVD

Medium

CVE-2020-14795

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.57 and 8.58. Easily exploitable vulner…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14792

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.…

CVSS: 4.2 CWE: N/A View on NVD

Medium

CVE-2020-14788

Vulnerability in the Oracle Communications Diameter Signaling Router (DSR) product of Oracle Communications (component: User Interface). Supported versions that are affected are 8.0.0.0-8.4.0.5. Easi…

CVSS: 6.1 CWE: N/A View on NVD

High

CVE-2020-14784

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Mobile Service). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploi…

CVSS: 8.2 CWE: N/A View on NVD

Medium

CVE-2020-14783

Vulnerability in the Oracle Hospitality RES 3700 product of Oracle Food and Beverage Applications (component: CAL). The supported version that is affected is 5.7. Easily exploitable vulnerability all…

CVSS: 5.3 CWE: N/A View on NVD

Low

CVE-2020-14782

CVSS: 3.7 CWE: N/A View on NVD

Low

CVE-2020-14781

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Dif…

CVSS: 3.7 CWE: N/A View on NVD

High

CVE-2020-14780

CVSS: 7.1 CWE: N/A View on NVD

Low

CVE-2020-14779

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8…

CVSS: 3.7 CWE: N/A View on NVD

High

CVE-2020-14774

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily…

CVSS: 7.5 CWE: N/A View on NVD

Medium

CVE-2020-14767

Vulnerability in the Hyperion BI+ product of Oracle Hyperion (component: IQR-Foundation service). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high pr…

CVSS: 4.2 CWE: N/A View on NVD

High

CVE-2020-14766

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Administration). Supported versions that are affected are 5.5.0.0.0,…

CVSS: 7.1 CWE: N/A View on NVD

Medium

CVE-2020-14761

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.7. Ea…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-14758

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with l…

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2020-14757

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). The supported version that is affected is 12.2.1.3.0. Difficult to exploit vulnerability all…

CVSS: 6.8 CWE: N/A View on NVD

Medium

CVE-2020-14753

Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). The supported version that is affected is 9.1.0. Easily exp…

CVSS: 5.9 CWE: N/A View on NVD

Medium

CVE-2020-14746

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popup windows). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploita…

CVSS: 4.7 CWE: N/A View on NVD

Medium

CVE-2020-14744

Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalon…

CVSS: 6.5 CWE: N/A View on NVD

High

CVE-2020-14734

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows una…

CVSS: 8.1 CWE: N/A View on NVD

2020-10-20

Medium

CVE-2020-6367

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspectin…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the i…

CVSS: 5.3 CWE: CWE-918 - Server-Side Request Forgery (SSRF) View on NVD

Critical

CVE-2020-5640

Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.

CVSS: 9.8 CWE: N/A View on NVD

2020-10-19

High

CVE-2020-9113

HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module. Due to insufficient input validation, an unauthenticated attacker may craft B…

CVSS: 8.0 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

Critical

CVE-2020-24629

A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-10-16

Medium

CVE-2020-16943

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper author…

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2020-16904

<p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploited this vulnerability could invoke an HTT…

CVSS: 5.3 CWE: CWE-863 - Incorrect Authorization View on NVD

Medium

CVE-2020-1680

On Juniper Networks MX Series with MS-MIC or MS-MPC card configured with NAT64 configuration, receipt of a malformed IPv6 packet may crash the MS-PIC component on MS-MIC or MS-MPC. This issue occurs…

CVSS: 5.3 CWE: CWE-131 - Incorrect Calculation of Buffer Size View on NVD

High

CVE-2020-1673

Insufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and…

CVSS: 8.8 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-24408

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability coul…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-14299

A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. T…

CVSS: 6.5 CWE: CWE-287 - Improper Authentication View on NVD

Critical

CVE-2020-26943

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the us…

CVSS: 9.9 CWE: N/A View on NVD

2020-10-15

Medium

CVE-2020-15793

A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could al…

CVSS: 5.4 CWE: CWE-1021 - Improper Restriction of Rendered UI Layers or Frames View on NVD

Medium

CVE-2020-11637

A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a de…

CVSS: 5.8 CWE: CWE-401 - Missing Release of Memory after Effective Lifetime View on NVD

High

CVE-2020-27157

Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server. An unauthenticated user could login to…

CVSS: 8.1 CWE: CWE-294 - Authentication Bypass by Capture-replay View on NVD

Critical

CVE-2020-27156

Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user.

CVSS: 9.8 CWE: CWE-863 - Incorrect Authorization View on NVD

Medium

CVE-2020-6368

SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorizat…

CVSS: 5.4 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-6319

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different sy…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

2020-10-14

High

CVE-2020-8350

An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege.

CVSS: 8.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-10-13

Critical

CVE-2020-13957

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that…

CVSS: 9.8 CWE: CWE-863 - Incorrect Authorization View on NVD

Medium

CVE-2020-15797

A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-20…

CVSS: 6.8 CWE: CWE-269 - Improper Privilege Management View on NVD

2020-10-12

Medium

CVE-2020-9108

HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends…

CVSS: 5.5 CWE: CWE-125 - Out-of-bounds Read View on NVD

Medium

CVE-2020-9107

CVSS: 5.5 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2020-26868

ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitima…

CVSS: 7.5 CWE: CWE-767 - Access to Critical Private Variable via Public Method View on NVD

Medium

CVE-2020-4774

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker…

CVSS: 5.4 CWE: CWE-91 - XML Injection (aka Blind XPath Injection) View on NVD

Medium

CVE-2020-5143

SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS…

CVSS: 5.3 CWE: CWE-203 - Observable Discrepancy View on NVD

Medium

CVE-2020-5142

A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in t…

CVSS: 6.1 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

Medium

CVE-2020-5141

A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7,…

CVSS: 6.5 CWE: CWE-799 - Improper Control of Interaction Frequency View on NVD

High

CVE-2020-5140

A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses…

CVSS: 7.5 CWE: CWE-125 - Out-of-bounds Read View on NVD