← Back
CWE-863

3,308 CVEs • Abstraction: Class • Likelihood of Exploit: High

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

JSON object

Loading...

CVEs (3,308)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-4577
4Canonical
DovecotFedoraproject+1 more
4Dovecot
FedoraOpensuse+1 more
Apr 23, 2026
Oct 15, 2008
N/A· v4
7.5 HIGH· v3
6.4 MEDIUM· v2
The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
CVE-2008-3424
2Condor Project
Fedoraproject
2Condor
Fedora
Apr 23, 2026
Jul 31, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypas...Show more
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.Show less
CVE-2008-0595
4Fedoraproject
FreedesktopMandrakesoft+1 more
4Dbus
Enterprise LinuxFedora+1 more
Apr 23, 2026
Feb 29, 2008
N/A· v4
N/A· v3
4.6 MEDIUM· v2
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intend...Show more
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.Show less
CVE-2007-3968
1Dirlist
1Dirlist Php
Apr 23, 2026
Jul 25, 2007
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
index.php in dirLIST before 0.1.1 allows remote attackers to list the contents of an excluded folder via a modified URL containing the folder name.
CVE-2007-2586
1Cisco
1Ios
Apr 23, 2026
May 10, 2007
N/A· v4
N/A· v3
9.3 HIGH· v2
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated b...Show more
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.Show less
CVE-2006-6679
1Chetcpasswd Project
1Chetcpasswd
Apr 23, 2026
Dec 21, 2006
N/A· v4
7.5 HIGH· v3
7.5 HIGH· v2
Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header.
CVE-2005-2136
1Raritan
5Dominion Sx16 Firmware
Dominion Sx32 FirmwareDominion Sx4 Firmware+2 more
Apr 16, 2026
Jul 5, 2005
N/A· v4
N/A· v3
4.6 MEDIUM· v2
Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain h...Show more
Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.Show less
CVE-2001-1155
1Freebsd
1Freebsd
Apr 16, 2026
Aug 23, 2001
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restr...Show more
TCP Wrappers (tcp_wrappers) in FreeBSD 4.1.1 through 4.3 with the PARANOID ACL option enabled does not properly check the result of a reverse DNS lookup, which could allow remote attackers to bypass intended access restrictions via DNS spoofing.Show less