CWE-863 · Incorrect Authorization (page 16)
Page 16 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0360 | High | 7.8 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could l… |
CVE-2025-0359 | High | 8.5 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicati… |
CVE-2024-2321 | Medium | 5.6 | 2025-02-27 | An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the… |
CVE-2025-26532 | Low | 3.1 | 2025-02-24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
CVE-2025-26531 | Low | 3.1 | 2025-02-24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access. |
CVE-2025-26526 | Medium | 6.5 | 2025-02-24 | Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. |
CVE-2025-24526 | Medium | 4.3 | 2025-02-24 | Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channe… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2025-27089 | Medium | 5.4 | 2025-02-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` ac… |
CVE-2024-45081 | Medium | 6.5 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect a… |
CVE-2024-39328 | Medium | 6.8 | 2025-02-18 | Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their configuration privileges in a multi-par… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2025-26511 | High | 8.8 | 2025-02-13 | Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0… |
CVE-2025-0937 | High | 7.1 | 2025-02-12 | Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-0516 | Medium | 4.3 | 2025-02-12 | Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform u… |
CVE-2024-54916 | Medium | 6.8 | 2025-02-11 | An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by… |
CVE-2025-24437 | Medium | 5.4 | 2025-02-11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24436 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24434 | Critical | 9.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24421 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24420 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24419 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24409 | High | 8.2 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could… |
CVE-2025-24407 | High | 7.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24872 | Medium | 4.3 | 2025-02-11 | The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on b… |
CVE-2025-24869 | Medium | 4.3 | 2025-02-11 | SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their… |
CVE-2025-24200 | Medium | 6.1 | 2025-02-10 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 1… |
CVE-2021-41528 | | 2025-02-07 | An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exp… | |
CVE-2025-23419 | Medium | 4.3 | 2025-02-05 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentic… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2024-57434 | High | 8.8 | 2025-01-31 | macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator. |
CVE-2024-23929 | High | 7.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authenticat… |
CVE-2025-24500 | | 2025-01-30 | The vulnerability allows an unauthenticated attacker to access information in PAM database. | |
CVE-2025-24099 | Medium | 5.1 | 2025-01-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be abl… |
CVE-2024-57438 | Medium | 5.4 | 2025-01-29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. |
CVE-2024-41140 | High | 8.1 | 2025-01-29 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. |
CVE-2025-24479 | | 2025-01-28 | A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access… | |
CVE-2025-23054 | Medium | 6.5 | 2025-01-28 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perfo… |
CVE-2025-23053 | Medium | 6.5 | 2025-01-28 | A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow… |
CVE-2025-0781 | High | 8.6 | 2025-01-28 | An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system le… |
CVE-2025-24141 | Low | 3.3 | 2025-01-27 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an u… |
CVE-2025-24121 | Low | 3.3 | 2025-01-27 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to m… |
CVE-2025-24114 | Medium | 5.5 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app ma… |
CVE-2024-54530 | Critical | 9.1 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, watchOS 11.2. Password autofil… |
CVE-2024-54512 | Critical | 9.1 | 2025-01-27 | The issue was addressed by removing the relevant flags. This issue is fixed in iOS 18.2 and iPadOS 18.2, watchOS 11.2. A system binary could be used to fingerp… |
CVE-2024-54488 | Medium | 5.3 | 2025-01-27 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7… |
CVE-2024-44172 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.3, macOS Ventura… |
CVE-2024-22316 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user… |
CVE-2023-50946 | Medium | 6.5 | 2025-01-26 | IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization me… |
CVE-2025-24401 | Medium | 6.8 | 2025-01-22 | Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potent… |
CVE-2025-24400 | Medium | 4.3 | 2025-01-22 | Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers a… |
CVE-2025-24397 | Medium | 4.3 | 2025-01-22 | An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure p… |
CVE-2024-42013 | Medium | 6.4 | 2025-01-22 | In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows administrative or debu… |
CVE-2025-21570 | Medium | 6.1 | 2025-01-21 | Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). The supported version that is affec… |
CVE-2025-21569 | Medium | 6.6 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). The supported version that is affecte… |
CVE-2025-21568 | Medium | 4.5 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is… |
CVE-2025-21567 | Medium | 4.3 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior… |
CVE-2025-21565 | High | 7.5 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily… |
CVE-2025-21563 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |
CVE-2025-21562 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |
CVE-2025-21561 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2… |
CVE-2025-21560 | Medium | 6.5 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). The supported version that is affec… |
CVE-2025-21558 | Medium | 5.4 | 2025-01-21 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported ve… |
CVE-2025-21557 | Medium | 5.4 | 2025-01-21 | Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability al… |
CVE-2025-21556 | Critical | 9.9 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affecte… |
CVE-2025-21555 | Medium | 5.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21554 | Medium | 5.3 | 2025-01-21 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-21553 | Medium | 4.2 | 2025-01-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.25, 21.3-21.16 and 23.4-23.6. Difficult to… |
CVE-2025-21546 | Low | 3.8 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21540 | Medium | 5.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21539 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is… |
CVE-2025-21537 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affec… |
CVE-2025-21533 | Medium | 5.5 | 2025-01-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and pr… |
CVE-2025-21519 | Medium | 4.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21517 | Medium | 4.3 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21516 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.5-12… |
CVE-2025-21506 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are… |
CVE-2025-21502 | Medium | 4.8 | 2025-01-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-51417 | Medium | 6.4 | 2025-01-21 | An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. |
CVE-2025-24460 | Medium | 4.3 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool |
CVE-2025-0580 | Medium | 5.6 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-57032 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is poss… |
CVE-2024-53553 | Critical | 9.1 | 2025-01-16 | An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. |
CVE-2024-57683 | Medium | 4.3 | 2025-01-16 | An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter setti… |
CVE-2024-57681 | Medium | 5.3 | 2025-01-16 | An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the… |
CVE-2024-57680 | Medium | 5.3 | 2025-01-16 | An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port tri… |
CVE-2024-57679 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and… |
CVE-2024-57678 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac ac… |
CVE-2024-57677 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the… |
CVE-2024-57676 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and… |
CVE-2024-44136 | Medium | 4.6 | 2025-01-15 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to a device may b… |
CVE-2024-40771 | High | 7.8 | 2025-01-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
CVE-2025-21403 | Medium | 6.4 | 2025-01-14 | On-Premises Data Gateway Information Disclosure Vulnerability |
CVE-2024-13302 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 befor… |
CVE-2024-13291 | High | 7.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 b… |
CVE-2024-13290 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4. |
CVE-2024-56114 | Medium | 6.5 | 2025-01-09 | Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authori… |
CVE-2024-13282 | High | 8.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0. |
CVE-2024-13281 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2. |