CWE-863 · Incorrect Authorization (page 18)
Page 18 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44196 | Medium | 5.5 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app ma… |
CVE-2024-44137 | Medium | 4.6 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical acc… |
CVE-2024-40855 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app m… |
CVE-2024-9825 | Medium | 5.4 | 2024-10-28 | The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object ref… |
CVE-2024-48936 | Medium | 5.0 | 2024-10-28 | SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under o… |
CVE-2024-48237 | Critical | 9.8 | 2024-10-25 | WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php. |
CVE-2022-30358 | High | 8.8 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters… |
CVE-2022-30356 | Medium | 4.7 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters… |
CVE-2024-49376 | High | 8.8 | 2024-10-25 | Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email… |
CVE-2024-47025 | Medium | 5.5 | 2024-10-25 | In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure w… |
CVE-2024-44099 | Medium | 5.5 | 2024-10-25 | There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execu… |
CVE-2024-41617 | Critical | 9.8 | 2024-10-24 | Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security… |
CVE-2024-45261 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not t… |
CVE-2024-45260 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can in… |
CVE-2024-10295 | High | 7.5 | 2024-10-24 | A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed bas… |
CVE-2024-48548 | Critical | 9.3 | 2024-10-24 | The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitraril… |
CVE-2024-48547 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzin… |
CVE-2024-48546 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48545 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48544 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyz… |
CVE-2024-48542 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information… |
CVE-2024-48541 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing th… |
CVE-2024-48540 | Medium | 6.2 | 2024-10-24 | Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file. |
CVE-2024-20482 | Medium | 6.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-49209 | Medium | 6.5 | 2024-10-22 | Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unpri… |
CVE-2024-49208 | Medium | 5.9 | 2024-10-22 | Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivile… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2024-38002 | Critical | 9.0 | 2024-10-22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through upda… |
CVE-2024-10173 | High | 7.3 | 2024-10-20 | A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console… |
CVE-2024-29821 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-29213 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-20420 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker w… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2024-21285 | High | 7.1 | 2024-10-15 | Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that i… |
CVE-2024-21284 | High | 7.1 | 2024-10-15 | Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that i… |
CVE-2024-21283 | High | 8.1 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that… |
CVE-2024-21282 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21280 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affected are 12.2.5-12.2… |
CVE-2024-21279 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.13. Easily… |
CVE-2024-21278 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). Supported version… |
CVE-2024-21277 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affe… |
CVE-2024-21276 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). Supported versions that are affected are 12.2.3-12.2.13… |
CVE-2024-21275 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.7-12.2.13. E… |
CVE-2024-21271 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). Supported versions that are affected… |
CVE-2024-21270 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Supported versions that are affected are 12.2… |
CVE-2024-21269 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). Supported versions that are affected are… |
CVE-2024-21268 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.11… |
CVE-2024-21267 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.12-12… |
CVE-2024-21266 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21265 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affected are 12.2.3-12… |
CVE-2024-21262 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily ex… |
CVE-2024-21260 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21259 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and pr… |
CVE-2024-21249 | Medium | 4.3 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Ea… |
CVE-2024-47876 | High | 8.8 | 2024-10-15 | Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a… |
CVE-2024-48911 | High | 7.8 | 2024-10-14 | OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored i… |
CVE-2024-48792 | High | 7.5 | 2024-10-14 | An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48772 | Critical | 9.1 | 2024-10-11 | An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48787 | Critical | 9.1 | 2024-10-11 | An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48786 | Critical | 9.1 | 2024-10-11 | An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48784 | Critical | 9.8 | 2024-10-11 | An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48778 | Critical | 9.1 | 2024-10-11 | An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update pr… |
CVE-2024-48769 | Critical | 9.1 | 2024-10-11 | An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-8970 | High | 8.2 | 2024-10-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-9623 | Medium | 4.9 | 2024-10-10 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-45132 | Medium | 6.5 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privil… |
CVE-2024-45131 | Medium | 5.4 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Secu… |
CVE-2024-45128 | Medium | 5.4 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Secu… |
CVE-2024-45125 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a sec… |
CVE-2024-7048 | Medium | 5.4 | 2024-10-10 | In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. Th… |
CVE-2024-45160 | Critical | 9.1 | 2024-10-09 | Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_pa… |
CVE-2024-47780 | Low | 3.1 | 2024-10-08 | TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointe… |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-47183 | High | 8.1 | 2024-10-04 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is… |
CVE-2024-47616 | Medium | 6.8 | 2024-10-02 | Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state… |
CVE-2024-47560 | High | 7.8 | 2024-10-01 | RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be ex… |
CVE-2024-47172 | Medium | 5.4 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve cert… |
CVE-2024-47077 | Medium | 6.5 | 2024-09-27 | authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that applicati… |
CVE-2024-9136 | Medium | 6.7 | 2024-09-27 | Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-8974 | Low | 2.6 | 2024-09-26 | Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions… |
CVE-2024-9155 | Medium | 4.3 | 2024-09-26 | Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an… |
CVE-2024-7108 | Critical | 9.8 | 2024-09-26 | Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This… |
CVE-2024-20510 | Medium | 4.7 | 2024-09-25 | A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent atta… |
CVE-2024-47078 | High | 8.1 | 2024-09-25 | Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQT… |
CVE-2023-25189 | Low | 3.3 | 2024-09-25 | BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, regardless of the acces… |
CVE-2024-6512 | Medium | 6.5 | 2024-09-25 | Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to ap… |
CVE-2024-6593 | Critical | 9.1 | 2024-09-25 | Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to exec… |
CVE-2024-6592 | Critical | 9.1 | 2024-09-25 | An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and… |
CVE-2024-8606 | High | 8.8 | 2024-09-23 | Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-44162 | High | 7.8 | 2024-09-17 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items. |
CVE-2024-40843 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system. |
CVE-2024-40770 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted… |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-2743 | Medium | 5.3 | 2024-09-12 | An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modif… |
CVE-2024-8691 | High | 7.1 | 2024-09-11 | A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another G… |
CVE-2024-4465 | Medium | 6.0 | 2024-09-11 | An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited p… |