CWE-285 · Improper Authorization (page 11)
Page 11 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28378 | Medium | 6.7 | 2023-11-14 | Improper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable esc… |
CVE-2023-36633 | Medium | 5.4 | 2023-11-14 | An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and… |
CVE-2023-47109 | Medium | 5.5 | 2023-11-08 | PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a… |
CVE-2023-42541 | Medium | 4.0 | 2023-11-07 | Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. |
CVE-2023-28556 | High | 7.1 | 2023-11-07 | Cryptographic issue in HLOS during key management. |
CVE-2023-5948 | Medium | 5.5 | 2023-11-03 | Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91. |
CVE-2023-42491 | High | 8.8 | 2023-10-25 | EisBaer Scada - CWE-285: Improper Authorization |
CVE-2021-4334 | High | 8.8 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_… |
CVE-2020-36714 | High | 7.4 | 2023-10-20 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to… |
CVE-2021-4335 | Medium | 6.3 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability ch… |
CVE-2023-5654 | Medium | 6.5 | 2023-10-19 | The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to… |
CVE-2023-38220 | High | 7.5 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Author… |
CVE-2023-41841 | High | 8.1 | 2023-10-10 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform… |
CVE-2023-3037 | High | 8.6 | 2023-10-04 | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform wi… |
CVE-2023-20186 | High | 8.0 | 2023-09-27 | A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated… |
CVE-2023-44125 | Medium | 6.1 | 2023-09-27 | The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files… |
CVE-2023-44123 | Medium | 6.1 | 2023-09-27 | The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with… |
CVE-2023-42453 | Low | 3.1 | 2023-09-27 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they… |
CVE-2023-28055 | High | 8.8 | 2023-09-27 | Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could po… |
CVE-2023-0456 | High | 7.4 | 2023-09-27 | A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a… |
CVE-2022-47553 | High | 8.6 | 2023-09-19 | Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, withou… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |
CVE-2023-33020 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE. |
CVE-2023-33019 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE. |
CVE-2023-28584 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA). |
CVE-2023-32678 | Medium | 6.5 | 2023-08-25 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream an… |
CVE-2023-38508 | Medium | 6.5 | 2023-08-24 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and T… |
CVE-2023-3899 | High | 7.8 | 2023-08-23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1… |
CVE-2023-39403 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39402 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39401 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39400 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39399 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39398 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-28385 | High | 8.2 | 2023-08-11 | Improper authorization in the Intel(R) NUC Pro Software Suite for Windows before version 2.0.0.9 may allow a privileged user to potentially enable escalation o… |
CVE-2023-4243 | High | 8.8 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due… |
CVE-2023-3957 | Medium | 4.3 | 2023-07-27 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_upda… |
CVE-2023-36826 | High | 7.7 | 2023-07-25 | Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a d… |
CVE-2023-23568 | Medium | 4.3 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affect… |
CVE-2023-25074 | High | 7.1 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects C… |
CVE-2023-22428 | High | 7.6 | 2023-07-24 | Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80… |
CVE-2023-3805 | High | 7.3 | 2023-07-21 | A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects… |
CVE-2023-32482 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push p… |
CVE-2023-3574 | Medium | 6.5 | 2023-07-10 | Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. |
CVE-2023-25517 | High | 7.1 | 2023-07-04 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not… |
CVE-2023-36611 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges t… |
CVE-2023-34460 | Medium | 4.8 | 2023-06-23 | Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles… |
CVE-2023-0837 | Medium | 6.6 | 2023-06-14 | An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged u… |
CVE-2023-33142 | Medium | 6.5 | 2023-06-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-32022 | High | 7.6 | 2023-06-14 | Windows Server Service Security Feature Bypass Vulnerability |
CVE-2023-1910 | Medium | 4.3 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote… |
CVE-2023-29152 | Medium | 6.2 | 2023-06-07 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account. |
CVE-2023-24476 | Low | 1.8 | 2023-06-07 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the… |
CVE-2021-4344 | Medium | 6.4 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling… |
CVE-2020-36729 | Medium | 5.4 | 2023-06-07 | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via… |
CVE-2020-36696 | High | 7.5 | 2023-06-07 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads()… |
CVE-2019-25149 | High | 7.6 | 2023-06-07 | The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated a… |
CVE-2023-30948 | Medium | 6.5 | 2023-06-06 | A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks… |
CVE-2022-40536 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network. |
CVE-2022-40521 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authorization in Modem |
CVE-2023-0584 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. T… |
CVE-2023-0583 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1… |
CVE-2023-34091 | Medium | 6.5 | 2023-06-01 | Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypa… |
CVE-2023-32717 | Medium | 4.3 | 2023-06-01 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{… |
CVE-2023-32709 | Medium | 4.3 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user… |
CVE-2023-32707 | High | 8.8 | 2023-06-01 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role… |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-33189 | Critical | 10.0 | 2023-05-30 | Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue… |
CVE-2023-33183 | Low | 2.6 | 2023-05-30 | Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server i… |
CVE-2023-2950 | High | 8.1 | 2023-05-28 | Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2496 | High | 7.1 | 2023-05-24 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability ch… |
CVE-2023-28623 | Medium | 6.5 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication b… |
CVE-2023-2782 | Medium | 5.5 | 2023-05-18 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38. |
CVE-2022-45450 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) bef… |
CVE-2023-20184 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20183 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20182 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-22348 | Medium | 4.3 | 2023-05-17 | Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |
CVE-2022-45128 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2022-43465 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2022-41610 | Medium | 5.0 | 2023-05-10 | Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to p… |
CVE-2023-28318 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server conf… |
CVE-2023-28317 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrec… |
CVE-2023-29338 | Medium | 6.6 | 2023-05-09 | Visual Studio Code Spoofing Vulnerability |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-21505 | Medium | 4.0 | 2023-05-04 | Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox. |
CVE-2023-30467 | High | 7.5 | 2023-04-28 | This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper au… |
CVE-2023-2345 | Medium | 6.3 | 2023-04-27 | A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2023-2227 | Critical | 9.1 | 2023-04-21 | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-28973 | High | 7.1 | 2023-04-17 | An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute… |
CVE-2022-3748 | Critical | 9.8 | 2023-04-14 | Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through… |
CVE-2023-26466 | High | 7.8 | 2023-04-10 | A user with non-Admin access can change a configuration file on the client to modify the Server URL. |
CVE-2023-1167 | Medium | 5.3 | 2023-04-05 | Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from… |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2023-0665 | Medium | 6.5 | 2023-03-30 | HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial… |
CVE-2022-3787 | High | 7.8 | 2023-03-29 | A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjuncti… |
CVE-2022-3685 | High | 7.5 | 2023-03-28 | A vulnerability exists in the SDM600 software. The software operates at a privilege level that is higher than the minimum level required. An attacker who succ… |
CVE-2022-3686 | Medium | 4.8 | 2023-03-28 | A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become… |
CVE-2022-3683 | High | 7.7 | 2023-03-28 | A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could r… |