CWE-863 · Incorrect Authorization (page 22)
Page 22 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-21311 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information di… |
CVE-2023-40117 | High | 7.8 | 2023-10-27 | In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of priv… |
CVE-2023-46754 | Medium | 5.3 | 2023-10-26 | The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. |
CVE-2023-46753 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an… |
CVE-2023-41077 | Medium | 5.5 | 2023-10-25 | An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks. |
CVE-2023-46125 | Medium | 6.5 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-43961 | High | 8.8 | 2023-10-25 | An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2023-43508 | Medium | 6.3 | 2023-10-25 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change th… |
CVE-2021-4334 | High | 8.8 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_… |
CVE-2020-36714 | High | 7.4 | 2023-10-20 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to… |
CVE-2023-34051 | Critical | 9.8 | 2023-10-20 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system… |
CVE-2023-22067 | Medium | 5.3 | 2023-10-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are… |
CVE-2023-43119 | Critical | 9.8 | 2023-10-16 | An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated priv… |
CVE-2023-29484 | Medium | 6.5 | 2023-10-16 | In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password. |
CVE-2023-38218 | High | 8.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Autho… |
CVE-2023-40829 | High | 7.5 | 2023-10-12 | There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000. |
CVE-2023-41882 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collabo… |
CVE-2023-35653 | Medium | 4.4 | 2023-10-11 | In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-28635 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allow… |
CVE-2023-5521 | Critical | 9.8 | 2023-10-11 | Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9. |
CVE-2023-36556 | High | 8.8 | 2023-10-10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an auth… |
CVE-2023-44860 | High | 7.5 | 2023-10-06 | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request. |
CVE-2022-3248 | Medium | 4.4 | 2023-10-05 | A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries… |
CVE-2023-1832 | Medium | 6.8 | 2023-10-04 | An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confident… |
CVE-2023-4997 | High | 8.8 | 2023-10-04 | Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users includ… |
CVE-2023-5106 | High | 8.2 | 2023-10-02 | An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to… |
CVE-2023-5195 | Medium | 6.5 | 2023-09-29 | Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of |
CVE-2023-5194 | Low | 2.7 | 2023-09-29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manag… |
CVE-2023-5193 | Medium | 4.9 | 2023-09-29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a… |
CVE-2023-5159 | Low | 3.8 | 2023-09-29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots… |
CVE-2023-5198 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16… |
CVE-2023-4532 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3979 | Low | 3.1 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3920 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-41078 | Medium | 5.5 | 2023-09-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy prefe… |
CVE-2023-35990 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be… |
CVE-2023-4853 | High | 8.1 | 2023-09-20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in inco… |
CVE-2022-47553 | High | 8.6 | 2023-09-19 | Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, withou… |
CVE-2023-5009 | High | 8.2 | 2023-09-19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possi… |
CVE-2023-4814 | High | 7.1 | 2023-09-14 | A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does… |
CVE-2023-20191 | Medium | 5.8 | 2023-09-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2023-20190 | Medium | 5.8 | 2023-09-13 | A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |
CVE-2023-37881 | Medium | 4.9 | 2023-09-12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2023-30995 | High | 7.5 | 2023-09-08 | IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP requ… |
CVE-2023-37367 | Medium | 5.3 | 2023-09-08 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exy… |
CVE-2023-38486 | High | 7.7 | 2023-09-06 | A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security control… |
CVE-2023-20269 | Medium | 5.0 | 2023-09-06 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-32672 | Medium | 4.3 | 2023-09-06 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tabl… |
CVE-2023-36387 | Medium | 5.4 | 2023-09-06 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database co… |
CVE-2023-27526 | Medium | 4.3 | 2023-09-06 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. |
CVE-2023-27523 | Medium | 5.0 | 2023-09-06 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on… |
CVE-2017-9453 | Critical | 9.0 | 2023-09-05 | BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. |
CVE-2023-4269 | Medium | 4.3 | 2023-09-04 | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subs… |
CVE-2023-3814 | Medium | 4.9 | 2023-09-04 | The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list a… |
CVE-2023-0120 | Low | 3.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-3253 | Medium | 4.3 | 2023-08-29 | An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the app… |
CVE-2023-34724 | Medium | 6.8 | 2023-08-28 | An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART interface. |
CVE-2023-4227 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to… |
CVE-2023-3899 | High | 7.8 | 2023-08-23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1… |
CVE-2022-48538 | Medium | 5.3 | 2023-08-22 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a ze… |
CVE-2023-38035 | Critical | 9.8 | 2023-08-21 | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication contr… |
CVE-2023-40315 | Medium | 5.3 | 2023-08-17 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate thei… |
CVE-2023-40168 | High | 7.4 | 2023-08-17 | TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project… |
CVE-2023-25647 | Medium | 4.7 | 2023-08-17 | There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor… |
CVE-2023-33237 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication… |
CVE-2023-32748 | Critical | 9.8 | 2023-08-14 | The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to… |
CVE-2023-39384 | High | 7.5 | 2023-08-13 | Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abn… |
CVE-2023-4107 | Medium | 6.7 | 2023-08-11 | Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details… |
CVE-2023-28714 | High | 8.2 | 2023-08-11 | Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user… |
CVE-2022-29871 | Medium | 6.7 | 2023-08-11 | Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2023-39965 | Medium | 6.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files throug… |
CVE-2023-30705 | Medium | 6.8 | 2023-08-10 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2023-33468 | Critical | 9.1 | 2023-08-09 | KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This… |
CVE-2023-24471 | Medium | 6.5 | 2023-08-09 | An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An a… |
CVE-2023-38209 | Medium | 6.5 | 2023-08-09 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that… |
CVE-2023-4242 | Medium | 4.3 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to impr… |
CVE-2023-37492 | Medium | 4.9 | 2023-08-08 | SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SA… |
CVE-2023-37491 | High | 7.5 | 2023-08-08 | The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53… |
CVE-2023-39363 | Medium | 5.9 | 2023-08-07 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated… |
CVE-2023-32783 | High | 7.5 | 2023-08-07 | The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a… |
CVE-2023-4194 | Medium | 5.5 | 2023-08-07 | A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to som… |
CVE-2023-20800 | Medium | 6.5 | 2023-08-07 | In imgsys, there is a possible system crash due to a mssing ptr check. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-28468 | Medium | 6.5 | 2023-08-03 | An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler t… |
CVE-2023-38958 | Medium | 5.3 | 2023-08-03 | An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotel… |
CVE-2023-23476 | Low | 3.1 | 2023-08-02 | IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some A… |
CVE-2023-36092 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerabili… |
CVE-2023-36091 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOT… |
CVE-2023-36090 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only… |
CVE-2023-36089 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cg… |
CVE-2023-38488 | High | 7.1 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might hav… |
CVE-2023-3957 | Medium | 4.3 | 2023-07-27 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_upda… |
CVE-2023-35983 | Medium | 5.5 | 2023-07-27 | This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be a… |
CVE-2023-39154 | Medium | 6.5 | 2023-07-26 | Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to con… |
CVE-2023-32629 | High | 7.8 | 2023-07-26 | Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu… |
CVE-2023-2640 | High | 7.8 | 2023-07-26 | On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may… |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2023-38493 | High | 7.5 | 2023-07-25 | Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or… |
CVE-2023-36826 | High | 7.7 | 2023-07-25 | Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a d… |