CWE-285 · Improper Authorization (page 13)
Page 13 of 17 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33020 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE. |
CVE-2023-33019 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE. |
CVE-2023-28584 | High | 7.5 | 2023-09-05 | Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA). |
CVE-2023-32678 | Medium | 6.5 | 2023-08-25 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream an… |
CVE-2023-38508 | Medium | 6.5 | 2023-08-24 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and T… |
CVE-2023-3899 | High | 7.8 | 2023-08-23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1… |
CVE-2023-39403 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39402 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39401 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39400 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39399 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39398 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-28385 | High | 8.2 | 2023-08-11 | Improper authorization in the Intel(R) NUC Pro Software Suite for Windows before version 2.0.0.9 may allow a privileged user to potentially enable escalation o… |
CVE-2023-4243 | High | 8.8 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due… |
CVE-2023-3957 | Medium | 4.3 | 2023-07-27 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_upda… |
CVE-2023-36826 | High | 7.7 | 2023-07-25 | Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a d… |
CVE-2023-23568 | Medium | 4.3 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affect… |
CVE-2023-25074 | High | 7.1 | 2023-07-25 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects C… |
CVE-2023-22428 | High | 7.6 | 2023-07-24 | Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80… |
CVE-2023-3805 | High | 7.3 | 2023-07-21 | A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects… |
CVE-2023-32482 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push p… |
CVE-2023-3574 | Medium | 6.5 | 2023-07-10 | Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. |
CVE-2023-25517 | High | 7.1 | 2023-07-04 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not… |
CVE-2023-36611 | Medium | 6.5 | 2023-07-03 | The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges t… |
CVE-2023-34460 | Medium | 4.8 | 2023-06-23 | Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles… |
CVE-2023-0837 | Medium | 6.6 | 2023-06-14 | An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged u… |
CVE-2023-33142 | Medium | 6.5 | 2023-06-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-32022 | High | 7.6 | 2023-06-14 | Windows Server Service Security Feature Bypass Vulnerability |
CVE-2023-1910 | Medium | 4.3 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote… |
CVE-2023-29152 | Medium | 6.2 | 2023-06-07 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account. |
CVE-2023-24476 | Low | 1.8 | 2023-06-07 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the… |
CVE-2021-4344 | Medium | 6.4 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling… |
CVE-2020-36729 | Medium | 5.4 | 2023-06-07 | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via… |
CVE-2020-36696 | High | 7.5 | 2023-06-07 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads()… |
CVE-2019-25149 | High | 7.6 | 2023-06-07 | The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated a… |
CVE-2023-30948 | Medium | 6.5 | 2023-06-06 | A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks… |
CVE-2022-40536 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network. |
CVE-2022-40521 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authorization in Modem |
CVE-2023-0584 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. T… |
CVE-2023-0583 | Medium | 4.3 | 2023-06-03 | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1… |
CVE-2023-34091 | Medium | 6.5 | 2023-06-01 | Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypa… |
CVE-2023-32717 | Medium | 4.3 | 2023-06-01 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{… |
CVE-2023-32709 | Medium | 4.3 | 2023-06-01 | In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user… |
CVE-2023-32707 | High | 8.8 | 2023-06-01 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role… |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-33189 | Critical | 10.0 | 2023-05-30 | Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue… |
CVE-2023-33183 | Low | 2.6 | 2023-05-30 | Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server i… |
CVE-2023-2950 | High | 8.1 | 2023-05-28 | Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2496 | High | 7.1 | 2023-05-24 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability ch… |
CVE-2023-28623 | Medium | 6.5 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication b… |
CVE-2023-2782 | Medium | 5.5 | 2023-05-18 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38. |
CVE-2022-45450 | High | 7.5 | 2023-05-18 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) bef… |
CVE-2023-20184 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20183 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-20182 | Medium | 5.4 | 2023-05-18 | Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container… |
CVE-2023-22348 | Medium | 4.3 | 2023-05-17 | Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |
CVE-2022-45128 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2022-43465 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2022-41610 | Medium | 5.0 | 2023-05-10 | Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to p… |
CVE-2023-28318 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server conf… |
CVE-2023-28317 | Medium | 5.3 | 2023-05-09 | A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrec… |
CVE-2023-29338 | Medium | 6.6 | 2023-05-09 | Visual Studio Code Spoofing Vulnerability |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-21505 | Medium | 4.0 | 2023-05-04 | Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox. |
CVE-2023-30467 | High | 7.5 | 2023-04-28 | This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper au… |
CVE-2023-2345 | Medium | 6.3 | 2023-04-27 | A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functiona… |
CVE-2023-2227 | Critical | 9.1 | 2023-04-21 | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-28973 | High | 7.1 | 2023-04-17 | An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute… |
CVE-2022-3748 | Critical | 9.8 | 2023-04-14 | Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through… |
CVE-2023-26466 | High | 7.8 | 2023-04-10 | A user with non-Admin access can change a configuration file on the client to modify the Server URL. |
CVE-2023-1167 | Medium | 5.3 | 2023-04-05 | Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from… |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2023-0665 | Medium | 6.5 | 2023-03-30 | HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial… |
CVE-2022-3787 | High | 7.8 | 2023-03-29 | A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjuncti… |
CVE-2022-3685 | High | 7.5 | 2023-03-28 | A vulnerability exists in the SDM600 software. The software operates at a privilege level that is higher than the minimum level required. An attacker who succ… |
CVE-2022-3686 | Medium | 4.8 | 2023-03-28 | A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become… |
CVE-2022-3683 | High | 7.7 | 2023-03-28 | A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could r… |
CVE-2022-40208 | Medium | 4.3 | 2023-03-24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
CVE-2023-27594 | Medium | 4.2 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific condit… |
CVE-2023-21461 | Medium | 4.0 | 2023-03-16 | Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via un… |
CVE-2023-21454 | Low | 2.4 | 2023-03-16 | Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen. |
CVE-2023-21452 | Low | 3.3 | 2023-03-16 | Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device. |
CVE-2022-46752 | Medium | 4.6 | 2023-03-08 | Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial… |
CVE-2023-0734 | Medium | 5.3 | 2023-03-05 | Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. |
CVE-2023-20088 | Medium | 5.3 | 2023-03-03 | A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote at… |
CVE-2023-1164 | High | 8.4 | 2023-03-03 | A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the comp… |
CVE-2023-22636 | High | 7.0 | 2023-02-27 | An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker t… |
CVE-2023-0914 | Medium | 5.3 | 2023-02-19 | Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4. |
CVE-2023-0822 | High | 8.8 | 2023-02-17 | The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizatio… |
CVE-2022-38375 | Critical | 9.1 | 2023-02-16 | An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform… |
CVE-2023-22938 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instan… |
CVE-2023-22931 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RS… |
CVE-2022-34446 | High | 8.8 | 2023-02-11 | PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated remote user with limited privileges (e.g… |
CVE-2023-21440 | Medium | 6.2 | 2023-02-09 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. |
CVE-2023-21436 | Low | 3.3 | 2023-02-09 | Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID. |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2023-21432 | Medium | 4.2 | 2023-02-09 | Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner. |
CVE-2023-21429 | Medium | 4.0 | 2023-02-09 | Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID. |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |