CWE-285 · Improper Authorization (page 12)
Page 12 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23670 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23667 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23665 | Medium | 5.9 | 2024-06-03 | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3… |
CVE-2024-36108 | Critical | 9.8 | 2024-05-31 | casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to obtain sensitive info… |
CVE-2024-3269 | Medium | 5.4 | 2024-05-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin f… |
CVE-2024-1803 | Medium | 4.3 | 2024-05-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-0870 | Medium | 5.3 | 2024-05-14 | The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_sta… |
CVE-2024-4819 | Medium | 4.3 | 2024-05-14 | A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file… |
CVE-2024-2441 | High | 8.1 | 2024-05-14 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privilege… |
CVE-2024-28285 | Critical | 9.8 | 2024-05-14 | A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same sy… |
CVE-2024-23576 | High | 7.1 | 2024-05-14 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized admini… |
CVE-2024-34257 | Critical | 9.8 | 2024-05-08 | TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowin… |
CVE-2024-33749 | Critical | 9.1 | 2024-05-06 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. |
CVE-2023-41819 | Medium | 6.1 | 2024-05-03 | A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content… |
CVE-2023-44410 | High | 8.8 | 2024-05-03 | D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affecte… |
CVE-2023-32168 | High | 8.8 | 2024-05-03 | D-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected… |
CVE-2023-6731 | Medium | 4.3 | 2024-05-02 | The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all version… |
CVE-2024-32359 | Medium | 6.9 | 2024-05-02 | An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of th… |
CVE-2023-47166 | High | 8.8 | 2024-05-01 | A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead… |
CVE-2024-32881 | Critical | 9.8 | 2024-04-26 | Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone… |
CVE-2023-50363 | High | 7.4 | 2024-04-26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-5675 | Medium | 6.5 | 2024-04-25 | A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Q… |
CVE-2024-3840 | High | 7.5 | 2024-04-17 | Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2024-21039 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21035 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21031 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21026 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-21018 | Medium | 6.1 | 2024-04-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affecte… |
CVE-2024-3027 | Medium | 6.4 | 2024-04-13 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all vers… |
CVE-2024-1289 | Medium | 6.5 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due… |
CVE-2024-26193 | Medium | 6.4 | 2024-04-09 | Azure Migrate Remote Code Execution Vulnerability |
CVE-2023-52539 | High | 7.5 | 2024-04-08 | Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52359 | High | 7.5 | 2024-04-08 | Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affe… |
CVE-2024-3434 | Medium | 5.4 | 2024-04-08 | A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-30260 | Low | 3.9 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear t… |
CVE-2024-3139 | Medium | 5.4 | 2024-04-01 | A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the fu… |
CVE-2024-3013 | Medium | 6.3 | 2024-03-28 | A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the… |
CVE-2024-0077 | High | 7.8 | 2024-03-27 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate resources for which the guest OS is not authoriz… |
CVE-2024-20333 | Medium | 4.3 | 2024-03-27 | A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to cha… |
CVE-2024-27916 | High | 7.1 | 2024-03-21 | Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByNam… |
CVE-2024-29033 | High | 7.5 | 2024-03-20 | OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 p… |
CVE-2024-2641 | Medium | 5.3 | 2024-03-19 | A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passw… |
CVE-2024-27937 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-27930 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-2557 | Medium | 5.3 | 2024-03-17 | A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-21761 | Medium | 4.3 | 2024-03-12 | An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organiz… |
CVE-2024-2317 | Low | 3.8 | 2024-03-08 | A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /… |
CVE-2024-25063 | High | 7.5 | 2024-03-02 | Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker… |
CVE-2024-24900 | Medium | 5.8 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker co… |
CVE-2024-1043 | Medium | 6.5 | 2024-02-29 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remov… |
CVE-2024-20943 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |
CVE-2023-38135 | Medium | 6.7 | 2024-02-14 | Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2024-21402 | High | 7.1 | 2024-02-13 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2024-25108 | Critical | 9.9 | 2024-02-12 | Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-23806 | Medium | 5.3 | 2024-02-07 | Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. |
CVE-2024-22021 | Medium | 4.3 | 2024-02-07 | Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the o… |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2023-32967 | Medium | 5.0 | 2024-02-02 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2024-23649 | High | 7.5 | 2024-01-24 | Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when th… |
CVE-2023-40683 | High | 8.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticati… |
CVE-2024-20979 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 an… |
CVE-2022-4962 | Medium | 4.3 | 2024-01-12 | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the c… |
CVE-2023-6878 | High | 8.8 | 2024-01-11 | The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_upd… |
CVE-2023-6496 | Medium | 5.3 | 2024-01-11 | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_expo… |
CVE-2023-40430 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent. |
CVE-2023-48252 | High | 8.8 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. |
CVE-2023-52139 | Critical | 9.0 | 2023-12-29 | Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorr… |
CVE-2023-50871 | Medium | 4.3 | 2023-12-15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed |
CVE-2023-41673 | High | 7.1 | 2023-12-13 | An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the ful… |
CVE-2023-6538 | High | 7.6 | 2023-12-11 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or co… |
CVE-2023-5808 | High | 7.6 | 2023-12-05 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrat… |
CVE-2023-48309 | Medium | 5.3 | 2023-11-20 | NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affecte… |
CVE-2023-48241 | High | 7.5 | 2023-11-20 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search sugge… |
CVE-2023-30954 | Low | 2.7 | 2023-11-15 | The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not y… |
CVE-2023-32662 | Medium | 6.7 | 2023-11-14 | Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to potentially enable… |
CVE-2023-28378 | Medium | 6.7 | 2023-11-14 | Improper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable esc… |
CVE-2023-36633 | Medium | 5.4 | 2023-11-14 | An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and… |
CVE-2023-47109 | Medium | 5.5 | 2023-11-08 | PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a… |
CVE-2023-42541 | Medium | 4.0 | 2023-11-07 | Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. |
CVE-2023-28556 | High | 7.1 | 2023-11-07 | Cryptographic issue in HLOS during key management. |
CVE-2023-5948 | Medium | 5.5 | 2023-11-03 | Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91. |
CVE-2023-42491 | High | 8.8 | 2023-10-25 | EisBaer Scada - CWE-285: Improper Authorization |
CVE-2021-4334 | High | 8.8 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_… |
CVE-2020-36714 | High | 7.4 | 2023-10-20 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to… |
CVE-2021-4335 | Medium | 6.3 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability ch… |
CVE-2023-5654 | Medium | 6.5 | 2023-10-19 | The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to… |
CVE-2023-38220 | High | 7.5 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Author… |
CVE-2023-41841 | High | 8.1 | 2023-10-10 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform… |
CVE-2023-3037 | High | 8.6 | 2023-10-04 | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform wi… |
CVE-2023-20186 | High | 8.0 | 2023-09-27 | A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated… |
CVE-2023-44125 | Medium | 6.1 | 2023-09-27 | The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files… |
CVE-2023-44123 | Medium | 6.1 | 2023-09-27 | The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with… |
CVE-2023-42453 | Low | 3.1 | 2023-09-27 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they… |
CVE-2023-28055 | High | 8.8 | 2023-09-27 | Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could po… |
CVE-2023-0456 | High | 7.4 | 2023-09-27 | A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a… |
CVE-2022-47553 | High | 8.6 | 2023-09-19 | Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, withou… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |