CWE-285 · Improper Authorization (page 9)
Page 9 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0580 | Medium | 5.6 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-55954 | High | 8.7 | 2025-01-16 | OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role u… |
CVE-2025-0484 | High | 7.3 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig… |
CVE-2025-23042 | High | 7.5 | 2025-01-14 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-21348 | High | 7.2 | 2025-01-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2025-21275 | High | 7.8 | 2025-01-14 | Windows App Package Installer Elevation of Privilege Vulnerability |
CVE-2024-56323 | Critical | 9.8 | 2025-01-13 | OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnera… |
CVE-2024-13241 | Critical | 9.1 | 2025-01-09 | Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before… |
CVE-2025-21611 | High | 8.8 | 2025-01-06 | tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of… |
CVE-2024-56320 | High | 8.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the… |
CVE-2024-13109 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects som… |
CVE-2024-56802 | | 2024-12-31 | Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key… | |
CVE-2024-13058 | | 2024-12-30 | An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and avai… | |
CVE-2020-9081 | Low | 3.5 | 2024-12-27 | There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this v… |
CVE-2024-45805 | Medium | 4.3 | 2024-12-26 | OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access… |
CVE-2024-45387 | Critical | 9.9 | 2024-12-23 | An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation… |
CVE-2024-12901 | Medium | 5.3 | 2024-12-23 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controlle… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-12782 | High | 7.3 | 2024-12-19 | A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerab… |
CVE-2024-11768 | Medium | 5.3 | 2024-12-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the check… |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-12483 | Low | 3.7 | 2024-12-12 | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User… |
CVE-2024-43731 | Medium | 4.3 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A… |
CVE-2024-43729 | Medium | 6.5 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A… |
CVE-2024-12347 | Medium | 5.3 | 2024-12-09 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-11860 | Medium | 6.5 | 2024-11-27 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rent… |
CVE-2024-36467 | High | 7.5 | 2024-11-27 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be… |
CVE-2024-8676 | High | 7.4 | 2024-11-26 | A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that r… |
CVE-2024-10729 | High | 8.8 | 2024-11-26 | The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-52287 | High | 7.2 | 2024-11-21 | authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token fr… |
CVE-2020-3539 | Medium | 6.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify… |
CVE-2024-48901 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit th… |
CVE-2024-48897 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
CVE-2024-11306 | Medium | 5.3 | 2024-11-18 | A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processin… |
CVE-2024-38370 | Medium | 5.3 | 2024-11-15 | GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appr… |
CVE-2024-52528 | | 2024-11-15 | Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway… | |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2022-31671 | High | 7.4 | 2024-11-14 | Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attemp… |
CVE-2022-31670 | High | 7.7 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that bel… |
CVE-2022-31669 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id th… |
CVE-2022-31668 | High | 7.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs t… |
CVE-2022-31667 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By… |
CVE-2022-31666 | High | 7.7 | 2024-11-14 | Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users… |
CVE-2024-43602 | Critical | 9.9 | 2024-11-12 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-51525 | Medium | 6.2 | 2024-11-05 | Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-10654 | Medium | 5.3 | 2024-11-01 | A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-10598 | Medium | 5.3 | 2024-10-31 | A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/… |
CVE-2024-48921 | Low | 2.7 | 2024-10-29 | Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a Polic… |
CVE-2024-9235 | High | 8.8 | 2024-10-25 | The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capabi… |
CVE-2024-9531 | Medium | 4.3 | 2024-10-24 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2020-36841 | Medium | 5.3 | 2024-10-16 | The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init… |
CVE-2024-47876 | High | 8.8 | 2024-10-15 | Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a… |
CVE-2023-50780 | High | 8.8 | 2024-10-14 | Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint… |
CVE-2024-47165 | Medium | 5.4 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When… |
CVE-2024-47084 | High | 8.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fa… |
CVE-2024-38129 | High | 7.5 | 2024-10-08 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-47183 | High | 8.1 | 2024-10-04 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is… |
CVE-2024-20441 | Medium | 5.7 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on a… |
CVE-2024-20393 | High | 8.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2024-9297 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-20414 | Medium | 6.5 | 2024-09-25 | A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site r… |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-43460 | High | 8.1 | 2024-09-17 | Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network. |
CVE-2024-46942 | Medium | 6.5 | 2024-09-15 | In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight… |
CVE-2024-6840 | Medium | 6.6 | 2024-09-12 | An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with… |
CVE-2024-20381 | High | 8.8 | 2024-09-11 | A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interface… |
CVE-2024-43482 | Medium | 6.5 | 2024-09-10 | Microsoft Outlook for iOS Information Disclosure Vulnerability |
CVE-2024-38231 | Medium | 6.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Denial of Service Vulnerability |
CVE-2024-45044 | High | 8.8 | 2024-09-10 | Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command… |
CVE-2024-8509 | High | 7.5 | 2024-09-06 | A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication. Wi… |
CVE-2024-20497 | Medium | 4.3 | 2024-09-04 | A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system. T… |
CVE-2024-42039 | Medium | 4.3 | 2024-09-04 | Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45307 | High | 8.8 | 2024-09-03 | SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretica… |
CVE-2024-34463 | Medium | 5.1 | 2024-09-03 | BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The packet data also lacks authentication an… |
CVE-2024-5053 | Medium | 4.2 | 2024-09-01 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key… |
CVE-2024-42490 | High | 7.5 | 2024-08-22 | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoi… |
CVE-2024-7851 | Medium | 6.3 | 2024-08-16 | A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-6347 | Medium | 6.5 | 2024-08-15 | * Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger d… |
CVE-2024-7624 | High | 8.1 | 2024-08-15 | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the… |
CVE-2024-7799 | Medium | 5.3 | 2024-08-15 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-39419 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39418 | Medium | 5.4 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39417 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39416 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39415 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39413 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39412 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39411 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39407 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39405 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-39404 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-6384 | Medium | 5.3 | 2024-08-13 | "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterpri… |
CVE-2024-42036 | Low | 2.5 | 2024-08-08 | Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42032 | Medium | 4.4 | 2024-08-08 | Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-7578 | High | 7.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/… |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-41962 | Medium | 4.6 | 2024-08-01 | Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is se… |
CVE-2024-40814 | High | 7.1 | 2024-07-29 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Ventura 13.7. An app may be able to… |