CWE-285 · Improper Authorization (page 12)
Page 12 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40208 | Medium | 4.3 | 2023-03-24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
CVE-2023-27594 | Medium | 4.2 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific condit… |
CVE-2023-21461 | Medium | 4.0 | 2023-03-16 | Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via un… |
CVE-2023-21454 | Low | 2.4 | 2023-03-16 | Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen. |
CVE-2023-21452 | Low | 3.3 | 2023-03-16 | Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device. |
CVE-2022-46752 | Medium | 4.6 | 2023-03-08 | Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial… |
CVE-2023-0734 | Medium | 5.3 | 2023-03-05 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-20088 | Medium | 5.3 | 2023-03-03 | A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote at… |
CVE-2023-1164 | High | 8.4 | 2023-03-03 | A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the comp… |
CVE-2023-22636 | High | 7.0 | 2023-02-27 | An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker t… |
CVE-2023-0914 | Medium | 5.3 | 2023-02-19 | Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4. |
CVE-2023-0822 | High | 8.8 | 2023-02-17 | The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizatio… |
CVE-2022-38375 | Critical | 9.1 | 2023-02-16 | An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform… |
CVE-2023-22938 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instan… |
CVE-2023-22931 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RS… |
CVE-2022-34446 | High | 8.8 | 2023-02-11 | PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated remote user with limited privileges (e.g… |
CVE-2023-21440 | Medium | 6.2 | 2023-02-09 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. |
CVE-2023-21436 | Low | 3.3 | 2023-02-09 | Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID. |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2023-21432 | Medium | 4.2 | 2023-02-09 | Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner. |
CVE-2023-21429 | Medium | 4.0 | 2023-02-09 | Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID. |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |
CVE-2023-21423 | Medium | 5.1 | 2023-02-09 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unp… |
CVE-2023-21422 | Medium | 5.7 | 2023-02-09 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without per… |
CVE-2023-23696 | High | 7.0 | 2023-02-07 | Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could p… |
CVE-2022-3229 | Critical | 9.8 | 2023-02-06 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker ca… |
CVE-2022-24894 | Medium | 5.9 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It ca… |
CVE-2023-0610 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2023-0609 | Medium | 4.3 | 2023-02-01 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. |
CVE-2022-4062 | High | 7.8 | 2023-02-01 | A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to local… |
CVE-2022-3740 | Medium | 6.5 | 2023-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group… |
CVE-2022-34405 | High | 7.3 | 2023-01-26 | An improper access control vulnerability was identified in the Realtek audio driver. A local authenticated malicious user may potentially exploit this vulnerab… |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-21549 | High | 8.8 | 2023-01-10 | Windows SMB Witness Service Elevation of Privilege Vulnerability |
CVE-2022-4701 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up… |
CVE-2015-10033 | Low | 3.5 | 2023-01-09 | A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipu… |
CVE-2022-4879 | Medium | 4.6 | 2023-01-06 | A vulnerability was found in Forged Alliance Forever up to 3746. It has been declared as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2022-4868 | Medium | 4.3 | 2022-12-31 | Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-45874 | Medium | 5.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file. |
CVE-2022-4804 | Medium | 5.3 | 2022-12-28 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4688 | High | 8.8 | 2022-12-23 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-29913 | Medium | 6.5 | 2022-12-22 | The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerabili… |
CVE-2022-3187 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established wit… |
CVE-2022-46312 | High | 7.5 | 2022-12-20 | The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of devi… |
CVE-2022-23542 | High | 7.7 | 2022-12-20 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered t… |
CVE-2022-2536 | Medium | 5.3 | 2022-12-15 | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and includin… |
CVE-2022-47409 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-39905 | Medium | 4.0 | 2022-12-08 | Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit int… |
CVE-2022-39902 | Medium | 6.5 | 2022-12-08 | Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call. |
CVE-2022-39890 | Medium | 6.2 | 2022-11-09 | Improper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get sensitive information. |
CVE-2022-39883 | Medium | 4.0 | 2022-11-09 | Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API. |
CVE-2022-39879 | Medium | 5.9 | 2022-11-09 | Improper authorization vulnerability in?CallBGProvider prior to SMR Nov-2022 Release 1 allows local attacker to grant permission for accessing information with… |
CVE-2022-39356 | High | 8.9 | 2022-11-02 | Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin use… |
CVE-2022-27583 | Critical | 9.1 | 2022-10-31 | A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version t… |
CVE-2022-39329 | Low | 3.5 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2022-36454 | Medium | 6.5 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to… |
CVE-2022-36453 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters d… |
CVE-2022-39342 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose mod… |
CVE-2022-39341 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have… |
CVE-2022-39340 | Medium | 5.3 | 2022-10-25 | OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, result… |
CVE-2022-39322 | Critical | 9.1 | 2022-10-25 | @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who e… |
CVE-2022-42961 | Medium | 5.3 | 2022-10-15 | An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operatio… |
CVE-2022-34434 | Medium | 6.7 | 2022-10-11 | Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with… |
CVE-2022-39873 | Medium | 4.3 | 2022-10-07 | Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user auth… |
CVE-2022-39862 | Medium | 5.3 | 2022-10-07 | Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascr… |
CVE-2022-32170 | Medium | 4.3 | 2022-09-28 | The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “A… |
CVE-2022-32169 | Medium | 4.3 | 2022-09-28 | The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues… |
CVE-2022-29490 | High | 8.5 | 2022-09-12 | Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any Micr… |
CVE-2022-36110 | High | 8.8 | 2022-09-09 | Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If… |
CVE-2022-36876 | Low | 1.8 | 2022-09-09 | Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. |
CVE-2022-36872 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36871 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36870 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to… |
CVE-2022-36857 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data. |
CVE-2022-36852 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application data. |
CVE-2022-36848 | Medium | 5.1 | 2022-09-09 | Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent denial of service. |
CVE-2022-36090 | High | 8.1 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a c… |
CVE-2022-31167 | High | 7.1 | 2022-09-07 | XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13… |
CVE-2022-31247 | Critical | 9.1 | 2022-09-07 | An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role temp… |
CVE-2022-2901 | High | 7.1 | 2022-09-06 | Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. |
CVE-2022-20921 | High | 8.8 | 2022-08-25 | A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an… |
CVE-2022-32838 | Medium | 5.5 | 2022-08-24 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina… |
CVE-2022-34256 | High | 7.5 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that cou… |
CVE-2022-2661 | Critical | 9.9 | 2022-08-16 | Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically cr… |
CVE-2022-31609 | High | 7.8 | 2022-08-05 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest… |
CVE-2022-2675 | Medium | 6.5 | 2022-08-05 | Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an… |
CVE-2022-36838 | Medium | 4.0 | 2022-08-05 | Implicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information. |
CVE-2022-36837 | Medium | 6.2 | 2022-08-05 | Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information. |
CVE-2022-33722 | Medium | 4.0 | 2022-08-05 | Implicit Intent hijacking vulnerability in Smart View prior to SMR Aug-2022 Release 1 allows attacker to access connected device MAC address. |
CVE-2022-2595 | Critical | 10.0 | 2022-08-01 | Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2022-24083 | Critical | 9.8 | 2022-07-25 | Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. |
CVE-2022-31168 | Medium | 5.4 | 2022-07-22 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API… |
CVE-2022-2393 | Medium | 5.7 | 2022-07-14 | A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw… |
CVE-2022-33713 | High | 7.5 | 2022-07-12 | Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information. |
CVE-2022-33712 | Medium | 5.3 | 2022-07-12 | Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allow… |
CVE-2022-33705 | Low | 3.3 | 2022-07-12 | Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission. |
CVE-2022-33702 | Medium | 6.2 | 2022-07-12 | Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyguard and bypass Knoxguard lock by factor… |
CVE-2022-30757 | Medium | 4.0 | 2022-07-12 | Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permission. |
CVE-2022-30670 | High | 8.8 | 2022-06-16 | RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An auth… |