CWE-863 · Incorrect Authorization (page 17)
Page 17 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13278 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0. |
CVE-2024-13277 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1. |
CVE-2024-13271 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4. |
CVE-2024-13270 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1. |
CVE-2024-13266 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from… |
CVE-2024-13258 | Critical | 9.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authen… |
CVE-2024-13257 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0… |
CVE-2024-13253 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notificat… |
CVE-2025-22449 | Low | 3.8 | 2025-01-09 | Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2025-0237 | Medium | 5.4 | 2025-01-07 | The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal bein… |
CVE-2024-39025 | High | 7.5 | 2024-12-27 | Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data. |
CVE-2020-9081 | Low | 3.5 | 2024-12-27 | There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this v… |
CVE-2024-47157 | Low | 2.9 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-47148 | Medium | 4.0 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-56431 | Critical | 9.8 | 2024-12-25 | oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because… |
CVE-2024-47102 | Medium | 5.5 | 2024-12-25 | IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial… |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-12831 | High | 7.8 | 2024-12-20 | Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2023-4617 | Critical | 10.0 | 2024-12-19 | Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other… |
CVE-2024-12539 | Medium | 6.5 | 2024-12-17 | An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security… |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-54662 | Critical | 9.1 | 2024-12-17 | Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. |
CVE-2024-9654 | Low | 3.7 | 2024-12-17 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient vali… |
CVE-2024-37775 | High | 7.5 | 2024-12-16 | Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check. |
CVE-2024-8650 | Medium | 5.3 | 2024-12-16 | An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-membe… |
CVE-2024-8116 | Medium | 5.3 | 2024-12-16 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific Gr… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-10043 | Low | 3.1 | 2024-12-12 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions s… |
CVE-2024-54495 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected… |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-55579 | High | 8.8 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection… |
CVE-2024-12247 | Medium | 4.6 | 2024-12-05 | Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a… |
CVE-2024-12196 | Medium | 6.5 | 2024-12-04 | Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of a… |
CVE-2024-12148 | Medium | 4.3 | 2024-12-04 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting e… |
CVE-2023-52944 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authentic… |
CVE-2023-52943 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authen… |
CVE-2024-45204 | Medium | 4.3 | 2024-12-04 | A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The ex… |
CVE-2024-42452 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escala… |
CVE-2024-42451 | Medium | 6.5 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of m… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-53937 | High | 8.8 | 2024-12-02 | An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default with ad… |
CVE-2024-53941 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote attacker (in proximity to a Wi-Fi netwo… |
CVE-2024-52732 | Critical | 9.1 | 2024-12-02 | Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. |
CVE-2024-36611 | High | 7.5 | 2024-11-29 | In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the usernam… |
CVE-2024-48651 | High | 7.5 | 2024-11-29 | In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_… |
CVE-2024-54124 | High | 8.8 | 2024-11-29 | In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen. |
CVE-2018-9374 | High | 7.8 | 2024-11-28 | In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with User execution… |
CVE-2024-11669 | Medium | 6.5 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints cou… |
CVE-2024-50671 | Medium | 4.3 | 2024-11-25 | Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get… |
CVE-2024-7915 | High | 7.8 | 2024-11-25 | The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. T… |
CVE-2024-11672 | Medium | 4.3 | 2024-11-25 | Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciou… |
CVE-2024-11670 | Medium | 5.4 | 2024-11-25 | Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authen… |
CVE-2024-11176 | | 2024-11-20 | Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluat… | |
CVE-2023-21270 | High | 7.8 | 2024-11-19 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect… |
CVE-2024-21287 | High | 7.5 | 2024-11-18 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported versio… |
CVE-2024-52584 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit t… |
CVE-2024-48901 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit th… |
CVE-2024-48897 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-50650 | High | 7.5 | 2024-11-15 | python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the… |
CVE-2024-50647 | High | 7.5 | 2024-11-15 | The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through… |
CVE-2024-31695 | Critical | 9.8 | 2024-11-14 | A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding… |
CVE-2024-3379 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for project… |
CVE-2022-31671 | High | 7.4 | 2024-11-14 | Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attemp… |
CVE-2022-31670 | High | 7.7 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that bel… |
CVE-2022-31669 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id th… |
CVE-2022-31668 | High | 7.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs t… |
CVE-2022-31667 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By… |
CVE-2024-9693 | High | 8.5 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 p… |
CVE-2024-45877 | Medium | 6.5 | 2024-11-13 | baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This al… |
CVE-2024-8001 | Medium | 5.3 | 2024-11-13 | A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulati… |
CVE-2024-50310 | High | 7.5 | 2024-11-12 | A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions >= V4.0.44 < V4.0.50). Affected devices do not properly handle… |
CVE-2024-43433 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. |
CVE-2024-42000 | Low | 2.7 | 2024-11-09 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which… |
CVE-2024-52314 | Medium | 4.9 | 2024-11-09 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applica… |
CVE-2024-52312 | Medium | 5.4 | 2024-11-09 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against Data… |
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |
CVE-2024-44765 | Medium | 6.5 | 2024-11-08 | An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass… |
CVE-2024-10975 | High | 7.7 | 2024-11-07 | Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container S… |
CVE-2024-20537 | Medium | 6.5 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-9902 | Medium | 6.3 | 2024-11-06 | A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system… |
CVE-2024-48176 | Critical | 9.8 | 2024-11-05 | Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshe… |
CVE-2024-30616 | High | 8.8 | 2024-11-04 | Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a si… |
CVE-2024-45164 | High | 7.1 | 2024-11-04 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal befor… |
CVE-2024-49256 | Medium | 5.4 | 2024-11-01 | Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2024-49501 | Medium | 5.7 | 2024-11-01 | Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the p… |
CVE-2024-51426 | High | 8.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer f… |
CVE-2024-51425 | High | 8.8 | 2024-10-30 | An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is di… |
CVE-2024-50419 | Medium | 5.4 | 2024-10-30 | Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-48921 | Low | 2.7 | 2024-10-29 | Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a Polic… |
CVE-2024-44217 | Critical | 9.1 | 2024-10-28 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may… |
CVE-2024-44301 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44289 | High | 7.5 | 2024-10-28 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventu… |
CVE-2024-44287 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44270 | High | 8.6 | 2024-10-28 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A sandboxed process… |
CVE-2024-44253 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modif… |
CVE-2024-44247 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |