CWE-1220 (page 2)
Page 2 of 2 — CVEs classified under CWE-1220, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6867 | Medium | 6.5 | 2024-09-13 | An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify tha… |
CVE-2024-42365 | High | 7.4 | 2024-08-08 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk v… |
CVE-2024-39324 | Low | 3.8 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, imp… |
CVE-2024-39323 | High | 7.1 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, a… |
CVE-2024-5389 | High | 8.1 | 2024-06-09 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variatio… |
CVE-2023-45217 | High | 8.8 | 2024-05-16 | Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-40070 | High | 8.8 | 2024-05-16 | Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-43040 | Medium | 6.5 | 2024-05-14 | IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2023-32259 | Medium | 6.5 | 2024-03-19 | Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploit… |
CVE-2023-6725 | Medium | 5.5 | 2024-03-15 | An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly mad… |
CVE-2024-26246 | Low | 3.9 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-2412 | Medium | 5.3 | 2024-03-13 | The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user reg… |
CVE-2023-50713 | Medium | 6.5 | 2023-12-14 | Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17… |
CVE-2023-44285 | High | 7.8 | 2023-12-14 | Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious… |
CVE-2023-4456 | Medium | 5.7 | 2023-08-21 | A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid fo… |
CVE-2023-39418 | Low | 3.1 | 2023-08-11 | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SE… |
CVE-2023-33127 | High | 8.1 | 2023-07-11 | .NET and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-3227 | Medium | 5.7 | 2023-06-14 | Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
CVE-2023-0205 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-0203 | Medium | 5.0 | 2023-04-22 | NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of… |
CVE-2023-27591 | High | 7.5 | 2023-03-17 | Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where t… |
CVE-2022-4813 | Medium | 4.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4801 | Medium | 5.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-2475 | Critical | 9.8 | 2022-10-28 | Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write… |
CVE-2022-36110 | High | 8.8 | 2022-09-09 | Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If… |
CVE-2022-1461 | Medium | 6.5 | 2022-04-25 | Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1. |
CVE-2022-1177 | Medium | 4.3 | 2022-03-30 | Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. |
CVE-2021-31384 | High | 7.2 | 2021-10-19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Ne… |