CWE-863 · Incorrect Authorization (page 20)
Page 20 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31682 | Critical | 9.8 | 2024-06-03 | Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass fingerprint authenticati… |
CVE-2024-32983 | High | 8.2 | 2024-06-03 | Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed Activit… |
CVE-2024-36963 | High | 7.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency… |
CVE-2024-35353 | Critical | 9.8 | 2024-05-30 | A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Users… |
CVE-2024-36377 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions |
CVE-2024-36376 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions |
CVE-2024-36365 | Medium | 6.8 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent |
CVE-2024-36364 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was… |
CVE-2024-36037 | Medium | 5.5 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings. |
CVE-2024-36055 | Medium | 5.5 | 2024-05-26 | Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIo… |
CVE-2024-1803 | Medium | 4.3 | 2024-05-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-5258 | Medium | 4.4 | 2024-05-23 | An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated att… |
CVE-2024-27312 | High | 8.1 | 2024-05-20 | Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This… |
CVE-2024-3745 | High | 7.8 | 2024-05-18 | MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE… |
CVE-2024-34434 | Medium | 6.5 | 2024-05-17 | Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue aff… |
CVE-2024-35187 | Critical | 9.1 | 2024-05-16 | Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user (includin… |
CVE-2024-31409 | Medium | 6.5 | 2024-05-15 | Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after… |
CVE-2024-3722 | Medium | 5.4 | 2024-05-14 | The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all ve… |
CVE-2024-34701 | Medium | 5.9 | 2024-05-14 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki req… |
CVE-2024-31441 | High | 7.5 | 2024-05-14 | DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is… |
CVE-2024-27798 | High | 7.8 | 2024-05-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An… |
CVE-2024-34346 | High | 8.4 | 2024-05-07 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write acces… |
CVE-2024-0043 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead… |
CVE-2024-28148 | Medium | 4.3 | 2024-05-07 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue a… |
CVE-2023-42124 | High | 7.8 | 2024-05-03 | Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate pri… |
CVE-2024-3957 | Medium | 6.5 | 2024-05-02 | The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthen… |
CVE-2024-1677 | Medium | 6.3 | 2024-05-02 | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of da… |
CVE-2024-34146 | Medium | 6.5 | 2024-05-02 | Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers w… |
CVE-2024-2378 | High | 8.0 | 2024-04-30 | A vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privileges on af-fected installations. |
CVE-2023-50363 | High | 7.4 | 2024-04-26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2024-4006 | Medium | 4.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all vers… |
CVE-2023-51405 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Boo… |
CVE-2024-28627 | High | 7.5 | 2024-04-23 | An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file. |
CVE-2024-32470 | Medium | 6.5 | 2024-04-18 | Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced i… |
CVE-2023-25043 | Medium | 4.3 | 2024-04-17 | Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25. |
CVE-2024-31452 | High | 8.1 | 2024-04-16 | OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass wh… |
CVE-2024-27086 | Low | 3.9 | 2024-04-16 | The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) u… |
CVE-2024-21120 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21083 | High | 7.2 | 2024-04-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Script Engine). Supported versions that are affected are 7.0.0.0.0 and 12.2… |
CVE-2024-21010 | Critical | 9.9 | 2024-04-16 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions… |
CVE-2024-1738 | High | 7.5 | 2024-04-16 | An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoi… |
CVE-2024-31990 | Medium | 4.8 | 2024-04-15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to us… |
CVE-2024-1307 | Medium | 6.5 | 2024-04-15 | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber… |
CVE-2024-27309 | High | 7.4 | 2024-04-12 | While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are ne… |
CVE-2024-3388 | Medium | 4.1 | 2024-04-10 | A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send netwo… |
CVE-2024-1741 | Critical | 9.1 | 2024-04-10 | lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an… |
CVE-2024-1740 | Critical | 9.1 | 2024-04-10 | In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using… |
CVE-2023-52538 | Critical | 9.1 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30260 | Low | 3.9 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear t… |
CVE-2024-29834 | Medium | 6.4 | 2024-04-02 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading t… |
CVE-2024-31134 | Medium | 6.5 | 2024-03-28 | In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled |
CVE-2024-29892 | Medium | 6.1 | 2024-03-27 | ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved cla… |
CVE-2024-23451 | Medium | 4.4 | 2024-03-27 | Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and b… |
CVE-2023-6400 | High | 7.4 | 2024-03-27 | Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENwo… |
CVE-2024-2915 | High | 8.8 | 2024-03-26 | Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elev… |
CVE-2024-27933 | High | 8.2 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of a… |
CVE-2024-27105 | High | 8.1 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less… |
CVE-2023-49982 | High | 8.8 | 2024-03-21 | Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Admini… |
CVE-2023-50811 | Medium | 6.5 | 2024-03-19 | An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception… |
CVE-2024-28394 | Critical | 9.8 | 2024-03-19 | An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom… |
CVE-2024-22412 | Low | 2.4 | 2024-03-18 | ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in git… |
CVE-2024-2557 | Medium | 5.3 | 2024-03-17 | A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2023-50886 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7. |
CVE-2024-23823 | Medium | 4.2 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The… |
CVE-2023-50726 | Medium | 6.4 | 2024-03-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an… |
CVE-2024-1479 | Medium | 5.3 | 2024-03-13 | The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display functio… |
CVE-2024-1452 | Medium | 4.3 | 2024-03-13 | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes… |
CVE-2024-28098 | Medium | 6.4 | 2024-03-12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading se… |
CVE-2023-45793 | Medium | 5.5 | 2024-03-12 | A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the list of access gro… |
CVE-2024-22133 | Medium | 4.6 | 2024-03-12 | SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to… |
CVE-2024-23262 | Low | 3.3 | 2024-03-08 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, visionOS 1.1. An ap… |
CVE-2024-23255 | Low | 2.4 | 2024-03-08 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Photos in the Hidden… |
CVE-2024-23250 | Medium | 5.5 | 2024-03-08 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A… |
CVE-2024-28229 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles |
CVE-2024-0199 | High | 7.7 | 2024-03-07 | An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An… |
CVE-2024-27915 | Medium | 6.8 | 2024-03-06 | Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permiss… |
CVE-2024-27288 | Medium | 6.3 | 2024-03-06 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access… |
CVE-2024-24761 | High | 7.5 | 2024-03-06 | Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per def… |
CVE-2024-28174 | Medium | 5.8 | 2024-03-06 | In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2023-47716 | Medium | 6.3 | 2024-03-01 | IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumsta… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-25170 | Critical | 9.1 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. |
CVE-2024-26016 | Medium | 4.3 | 2024-02-28 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ow… |
CVE-2024-24779 | Medium | 5.0 | 2024-02-28 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to d… |
CVE-2024-24773 | Medium | 4.9 | 2024-02-28 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Supers… |
CVE-2023-3509 | Low | 3.7 | 2024-02-21 | An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 bef… |
CVE-2024-26145 | Medium | 6.5 | 2024-02-21 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private… |
CVE-2023-46241 | Critical | 9.0 | 2024-02-21 | `discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can po… |
CVE-2023-42860 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app m… |
CVE-2024-1156 | High | 7.8 | 2024-02-20 | Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentia… |
CVE-2024-1155 | High | 7.8 | 2024-02-20 | Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalat… |
CVE-2024-25604 | Medium | 6.5 | 2024-02-20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsu… |
CVE-2024-25149 | Medium | 5.4 | 2024-02-20 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported ve… |
CVE-2023-52374 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52361 | High | 7.5 | 2024-02-18 | The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity. |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |
CVE-2024-0017 | Medium | 5.5 | 2024-02-16 | In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosu… |
CVE-2024-1482 | High | 7.1 | 2024-02-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and… |