CWE-285 · Improper Authorization (page 10)
Page 10 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40807 | Medium | 5.5 | 2024-07-29 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able… |
CVE-2024-40783 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6… |
CVE-2024-41670 | High | 7.5 | 2024-07-26 | In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer… |
CVE-2024-21179 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-21166 | Medium | 5.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior… |
CVE-2024-21159 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior… |
CVE-2024-21137 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-36438 | High | 7.3 | 2024-07-15 | eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to card duplication and… |
CVE-2024-30061 | High | 7.3 | 2024-07-09 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2024-39597 | High | 7.2 | 2024-07-09 | In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registrati… |
CVE-2024-6375 | Medium | 5.4 | 2024-07-01 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degra… |
CVE-2023-35022 | Low | 3.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. |
CVE-2024-38371 | High | 8.6 | 2024-06-28 | authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This cou… |
CVE-2024-37282 | High | 8.1 | 2024-06-28 | It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to cr… |
CVE-2024-3959 | Medium | 6.5 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-37167 | Medium | 4.3 | 2024-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see… |
CVE-2024-37159 | Low | 3.5 | 2024-06-17 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit t… |
CVE-2024-6000 | High | 7.1 | 2024-06-15 | The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_t… |
CVE-2024-34104 | High | 8.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security… |
CVE-2024-25949 | High | 8.8 | 2024-06-12 | Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote authenticated attac… |
CVE-2024-37154 | Medium | 5.3 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees… |
CVE-2024-36399 | High | 8.2 | 2024-06-06 | Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(… |
CVE-2024-23670 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23667 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23665 | Medium | 5.9 | 2024-06-03 | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3… |
CVE-2024-36108 | Critical | 9.8 | 2024-05-31 | casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to obtain sensitive info… |
CVE-2024-3269 | Medium | 5.4 | 2024-05-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin f… |
CVE-2024-1803 | Medium | 4.3 | 2024-05-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-0870 | Medium | 5.3 | 2024-05-14 | The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_sta… |
CVE-2024-4819 | Medium | 4.3 | 2024-05-14 | A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file… |
CVE-2024-2441 | High | 8.1 | 2024-05-14 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privilege… |
CVE-2024-28285 | Critical | 9.8 | 2024-05-14 | A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same sy… |
CVE-2024-23576 | High | 7.1 | 2024-05-14 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized admini… |
CVE-2024-34257 | Critical | 9.8 | 2024-05-08 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowin… |
CVE-2024-33749 | Critical | 9.1 | 2024-05-06 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. |
CVE-2023-41819 | Medium | 6.1 | 2024-05-03 | A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content… |
CVE-2023-44410 | High | 8.8 | 2024-05-03 | D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affecte… |
CVE-2023-32168 | High | 8.8 | 2024-05-03 | D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected… |
CVE-2023-6731 | Medium | 4.3 | 2024-05-02 | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all version… |
CVE-2024-32359 | Medium | 6.9 | 2024-05-02 | An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of th… |
CVE-2023-47166 | High | 8.8 | 2024-05-01 | A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead… |
CVE-2024-32881 | Critical | 9.8 | 2024-04-26 | Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone… |
CVE-2023-50363 | High | 7.4 | 2024-04-26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-5675 | Medium | 6.5 | 2024-04-25 | A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Q… |
CVE-2024-3840 | High | 7.5 | 2024-04-17 | Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2024-21039 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21035 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21031 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21026 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21018 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-3027 | Medium | 6.4 | 2024-04-13 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all vers… |
CVE-2024-1289 | Medium | 6.5 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due… |
CVE-2024-26193 | Medium | 6.4 | 2024-04-09 | Azure Migrate Remote Code Execution Vulnerability |
CVE-2023-52539 | High | 7.5 | 2024-04-08 | Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52359 | High | 7.5 | 2024-04-08 | Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affe… |
CVE-2024-3434 | Medium | 5.4 | 2024-04-08 | A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-30260 | Low | 3.9 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear t… |
CVE-2024-3139 | Medium | 5.4 | 2024-04-01 | A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the fu… |
CVE-2024-3013 | Medium | 6.3 | 2024-03-28 | A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the… |
CVE-2024-0077 | High | 7.8 | 2024-03-27 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate resources for which the guest OS is not authoriz… |
CVE-2024-20333 | Medium | 4.3 | 2024-03-27 | A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to cha… |
CVE-2024-27916 | High | 7.1 | 2024-03-21 | Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByNam… |
CVE-2024-29033 | High | 7.5 | 2024-03-20 | OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 p… |
CVE-2024-2641 | Medium | 5.3 | 2024-03-19 | A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passw… |
CVE-2024-27937 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-27930 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-2557 | Medium | 5.3 | 2024-03-17 | A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-21761 | Medium | 4.3 | 2024-03-12 | An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organiz… |
CVE-2024-2317 | Low | 3.8 | 2024-03-08 | A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /… |
CVE-2024-25063 | High | 7.5 | 2024-03-02 | Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker… |
CVE-2024-24900 | Medium | 5.8 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker co… |
CVE-2024-1043 | Medium | 6.5 | 2024-02-29 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remov… |
CVE-2024-20943 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |
CVE-2023-38135 | Medium | 6.7 | 2024-02-14 | Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2024-21402 | High | 7.1 | 2024-02-13 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2024-25108 | Critical | 9.9 | 2024-02-12 | Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-23806 | Medium | 5.3 | 2024-02-07 | Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. |
CVE-2024-22021 | Medium | 4.3 | 2024-02-07 | Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the o… |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2023-32967 | Medium | 5.0 | 2024-02-02 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2024-23649 | High | 7.5 | 2024-01-24 | Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when th… |
CVE-2023-40683 | High | 8.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticati… |
CVE-2024-20979 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 an… |
CVE-2022-4962 | Medium | 4.3 | 2024-01-12 | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the c… |
CVE-2023-6878 | High | 8.8 | 2024-01-11 | The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_upd… |
CVE-2023-6496 | Medium | 5.3 | 2024-01-11 | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_expo… |
CVE-2023-40430 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent. |
CVE-2023-48252 | High | 8.8 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. |
CVE-2023-52139 | Critical | 9.0 | 2023-12-29 | Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorr… |
CVE-2023-50871 | Medium | 4.3 | 2023-12-15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed |
CVE-2023-41673 | High | 7.1 | 2023-12-13 | An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the ful… |
CVE-2023-6538 | High | 7.6 | 2023-12-11 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or co… |
CVE-2023-5808 | High | 7.6 | 2023-12-05 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrat… |
CVE-2023-48309 | Medium | 5.3 | 2023-11-20 | NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affecte… |
CVE-2023-48241 | High | 7.5 | 2023-11-20 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search sugge… |
CVE-2023-30954 | Low | 2.7 | 2023-11-15 | The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not y… |
CVE-2023-32662 | Medium | 6.7 | 2023-11-14 | Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to potentially enable… |