The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,104 vulnerabilities with CWE-863
CVE-2021-22515
MEDIUM
NetIQ Advanced Authentication <6.3 SP4 Patch 1 - Auth Bypass
CVSS 4.8
CVE-2021-26273
HIGH
NinjaRMM 5.0.909 - Incorrect Authorization
CVSS 7.8
CVE-2021-24405
MEDIUM
easy_cookies_policy < 1.6.2 - Authenticated Stored Cross-Site Scripting via Settings Update
CVSS 6.5
CVE-2021-36132
HIGH
MediaWiki < 1.36 - Incorrect Authorization in FileImporter Extension
CVSS 8.8
CVE-2021-35197
HIGH
MediaWiki < 1.31.15, 1.32.x-1.35.x < 1.35.3, 1.36.x < 1.36.1 - Incorrect Authorization via Purge API
CVSS 7.5
CVE-2021-27661
HIGH
Johnson Controls F4-SNC Firmware - Authenticated Improper Privilege Management via Crafted Web Messages
CVSS 8.8
CVE-2021-22119
HIGH
Spring Security 5.2.0-5.2.10, 5.3.0-5.3.9, 5.4.0-5.4.6, 5.5.0 - Denial of Service via OAuth 2.0 Authorization Request
CVSS 7.5
CVE-2021-32716
MEDIUM
Shopware <6.4.1.1 - Info Disclosure
CVSS 4.4
CVE-2021-29961
MEDIUM
Firefox < 89.0 - User Interface Spoofing via Oversized Select Element
CVSS 4.3
CVE-2021-29959
MEDIUM
Firefox < 89.0 - Incorrect Authorization via Microphone and Camera Permissions
CVSS 4.3
CVE-2021-32701
HIGH
ORY Oathkeeper >=0.38.0-beta.2 <0.38.12-beta.1 - Incorrect Authorization via OAuth2 Introspection Cache
CVSS 7.5
CVE-2021-0571
HIGH
Android 11 - Incorrect Authorization in ActivityTaskManagerService and AppTaskImpl
CVSS 7.8
CVE-2021-24379
MEDIUM
Comments Like Dislike < 1.1.4 - Unauthenticated Like/Dislike Manipulation via AJAX Request Replay
CVSS 5.3
CVE-2021-26845
HIGH
Hitachi ABB Power Grids eSOMS 6.0-6.0.4.2.1 and 6.1-6.0.3 - Unauthorized Information Exposure via Report URL
CVSS 7.5
CVE-2021-0472
HIGH
Android - Local Privilege Escalation via App Pinning Permissions Bypass
CVSS 7.8
CVE-2021-25418
HIGH
Samsung Internet <14.0.1.62 - Privilege Escalation
CVSS 7.8
CVE-2021-25410
HIGH
CallBGProvider <SMR JUN-2021 Release 1 - Privilege Escalation
CVSS 7.1
CVE-2021-25406
MEDIUM
Gear S Plugin <2.2.05.20122441 - Info Disclosure
CVSS 6.5
CVE-2021-21664
MEDIUM
Jenkins XebiaLabs XL Deploy Plugin < 10.0.1 - Incorrect Authorization via URL Connection
CVSS 6.5
CVE-2021-30539
MEDIUM
Google Chrome < 91.0.4472.77 - Content Security Policy Bypass via Crafted HTML Page
CVSS 5.4
CVE-2021-30538
MEDIUM
Google Chrome < 91.0.4472.77 - Content Security Policy Bypass via Crafted HTML Page
CVSS 4.3
CVE-2021-30537
MEDIUM
Google Chrome <91.0.4472.77 - Auth Bypass
CVSS 4.3
CVE-2021-30534
MEDIUM
Google Chrome < 91.0.4472.77 - Insufficient Policy Enforcement in iFrameSandbox
CVSS 6.5
CVE-2021-30533
MEDIUM
KEV
Google Chrome < 91.0.4472.77 - Navigation Restriction Bypass via PopupBlocker
CVSS 6.5
CVE-2021-33881
MEDIUM
NXP MIFARE Ultralight and NTAG Firmware - Incorrect Authorization via Tear-Off Attack
CVSS 4.2
Details
Vulnerabilities
3,104
Exploit Likelihood
High