CWE-639 · Authorization Bypass Through User-Controlled Key (page 19)
Page 19 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51503 | Medium | 5.9 | 2023-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe… |
CVE-2023-50267 | Medium | 4.3 | 2023-12-28 | MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to… |
CVE-2023-46646 | Medium | 5.3 | 2023-12-21 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API en… |
CVE-2023-49765 | Medium | 4.3 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: f… |
CVE-2023-47191 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin fo… |
CVE-2023-32799 | Medium | 6.5 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from… |
CVE-2023-32747 | Medium | 5.4 | 2023-12-21 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1… |
CVE-2023-35916 | High | 7.5 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe… |
CVE-2023-35914 | High | 7.5 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2. |
CVE-2023-36520 | Medium | 5.4 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7… |
CVE-2023-35876 | High | 8.1 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1. |
CVE-2023-46311 | Low | 2.7 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7… |
CVE-2023-41796 | Medium | 5.3 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects S… |
CVE-2023-38513 | Medium | 5.4 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media… |
CVE-2023-37871 | High | 8.2 | 2023-12-20 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6. |
CVE-2023-6929 | High | 7.5 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to o… |
CVE-2022-43450 | Medium | 4.3 | 2023-12-19 | Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2. |
CVE-2023-49812 | Medium | 5.3 | 2023-12-19 | Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: fro… |
CVE-2023-46701 | Medium | 6.5 | 2023-12-12 | Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an att… |
CVE-2023-48641 | High | 7.5 | 2023-12-12 | Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-inst… |
CVE-2023-6341 | Medium | 5.3 | 2023-11-30 | Catalis (previously Icon Software) CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifie… |
CVE-2023-6226 | Medium | 4.3 | 2023-11-28 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1… |
CVE-2023-49298 | High | 7.5 | 2023-11-24 | OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace fil… |
CVE-2023-33706 | Medium | 6.5 | 2023-11-24 | SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modifi… |
CVE-2023-47316 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as l… |
CVE-2023-48304 | Medium | 4.3 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-6144 | Critical | 9.1 | 2023-11-21 | Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their usern… |
CVE-2023-38884 | High | 7.5 | 2023-11-20 | An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to a… |
CVE-2023-43900 | Medium | 6.5 | 2023-11-14 | Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other… |
CVE-2023-46446 | Medium | 6.8 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a… |
CVE-2023-5544 | Medium | 6.5 | 2023-11-09 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. |
CVE-2023-45380 | High | 8.8 | 2023-11-07 | In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download… |
CVE-2023-41356 | Medium | 6.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-38965 | Critical | 9.8 | 2023-11-03 | Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI. |
CVE-2023-4836 | Medium | 4.3 | 2023-10-31 | The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access… |
CVE-2023-46478 | High | 8.8 | 2023-10-30 | An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter. |
CVE-2023-3998 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions… |
CVE-2023-3869 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in vers… |
CVE-2022-24401 | High | 8.8 | 2023-10-19 | Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame c… |
CVE-2022-24400 | High | 7.5 | 2023-10-19 | A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-45393 | Medium | 6.5 | 2023-10-13 | An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a craft… |
CVE-2023-45396 | Medium | 6.5 | 2023-10-11 | An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12. |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-44249 | Medium | 4.3 | 2023-10-10 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7… |
CVE-2023-42455 | High | 8.8 | 2023-10-09 | Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator k… |
CVE-2023-26237 | Medium | 6.7 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. |
CVE-2023-2544 | Medium | 5.3 | 2023-10-03 | Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID… |
CVE-2023-32669 | Medium | 5.4 | 2023-10-03 | Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' al… |
CVE-2023-4101 | High | 8.8 | 2023-10-03 | The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prereq… |
CVE-2023-4099 | High | 7.6 | 2023-10-03 | The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. A… |
CVE-2023-38872 | Low | 3.7 | 2023-09-28 | An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker… |
CVE-2023-4934 | High | 8.8 | 2023-09-27 | Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: befor… |
CVE-2023-44206 | Critical | 9.1 | 2023-09-27 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows)… |
CVE-2023-44205 | Medium | 5.3 | 2023-09-27 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 359… |
CVE-2023-44154 | High | 8.1 | 2023-09-27 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows)… |
CVE-2023-42334 | Medium | 6.5 | 2023-09-20 | An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the user parameter. |
CVE-2023-4213 | High | 8.8 | 2023-09-13 | The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due… |
CVE-2023-41368 | Low | 2.7 | 2023-09-12 | The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating… |
CVE-2020-10130 | High | 8.8 | 2023-09-06 | SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system. |
CVE-2023-4587 | High | 8.3 | 2023-09-04 | An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user back… |
CVE-2023-2173 | Medium | 6.5 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validatio… |
CVE-2023-2172 | Medium | 4.3 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validatio… |
CVE-2023-0689 | Medium | 4.3 | 2023-08-31 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and inclu… |
CVE-2023-38201 | Medium | 6.5 | 2023-08-25 | A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attac… |
CVE-2023-32078 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user u… |
CVE-2023-27576 | Medium | 6.7 | 2023-08-18 | An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one… |
CVE-2023-28481 | High | 8.8 | 2023-08-14 | An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is… |
CVE-2023-37543 | High | 7.5 | 2023-08-10 | Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a… |
CVE-2023-2958 | Critical | 9.8 | 2023-07-17 | Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass. This issue affec… |
CVE-2023-3700 | Medium | 6.3 | 2023-07-17 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-2190 | Medium | 6.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all ver… |
CVE-2023-3105 | High | 8.8 | 2023-07-12 | The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin pr… |
CVE-2023-30960 | Medium | 4.3 | 2023-07-10 | A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This d… |
CVE-2023-30956 | Medium | 5.3 | 2023-07-10 | A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew th… |
CVE-2023-3219 | Medium | 5.3 | 2023-07-10 | The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unau… |
CVE-2023-37242 | Critical | 9.8 | 2023-07-06 | Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerability to rewrite the non-volatile rand… |
CVE-2022-42175 | High | 8.8 | 2023-07-05 | Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers… |
CVE-2023-3063 | High | 8.8 | 2023-06-30 | The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due t… |
CVE-2022-48505 | Medium | 5.5 | 2023-06-28 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system |
CVE-2023-32352 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5… |
CVE-2023-23679 | Medium | 4.6 | 2023-06-23 | Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACL… |
CVE-2023-26428 | Medium | 6.5 | 2023-06-20 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could b… |
CVE-2023-21131 | High | 7.8 | 2023-06-15 | In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code… |
CVE-2023-34000 | High | 7.5 | 2023-06-14 | Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions. |
CVE-2023-3048 | Critical | 9.8 | 2023-06-13 | Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass. This issue affects Lockcell… |
CVE-2023-1889 | Medium | 6.5 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper vali… |
CVE-2023-0694 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1… |
CVE-2023-0693 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and i… |
CVE-2023-0692 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and i… |
CVE-2023-0691 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and includ… |
CVE-2023-0688 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and includi… |
CVE-2021-33223 | High | 8.8 | 2023-06-07 | An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file. |
CVE-2023-0985 | High | 8.8 | 2023-06-06 | An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An… |
CVE-2023-33956 | Medium | 4.3 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object r… |
CVE-2023-3066 | High | 8.1 | 2023-06-05 | Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administrators… |
CVE-2023-32310 | High | 8.1 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to in… |
CVE-2022-36247 | Critical | 9.1 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za. |
CVE-2023-2978 | Medium | 4.6 | 2023-05-30 | A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the componen… |
CVE-2023-2883 | High | 8.8 | 2023-05-25 | Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot… |