CWE-863 · Incorrect Authorization (page 23)
Page 23 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38058 | Medium | 4.1 | 2023-07-24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an tick… |
CVE-2023-36339 | High | 7.5 | 2023-07-21 | An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request. |
CVE-2023-3484 | High | 8.0 | 2023-07-21 | An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all version… |
CVE-2023-32482 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push p… |
CVE-2023-32261 | Medium | 4.2 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permis… |
CVE-2023-34035 | High | 7.3 | 2023-07-18 | Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the appl… |
CVE-2022-26563 | High | 8.8 | 2023-07-18 | An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization. |
CVE-2023-3459 | High | 7.2 | 2023-07-18 | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_… |
CVE-2023-3613 | Low | 3.5 | 2023-07-17 | Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invite… |
CVE-2023-3590 | Low | 3.1 | 2023-07-17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
CVE-2023-3586 | Medium | 4.2 | 2023-07-17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boa… |
CVE-2023-3584 | Low | 3.1 | 2023-07-17 | Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated att… |
CVE-2023-3582 | Medium | 4.3 | 2023-07-17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private chann… |
CVE-2023-2759 | High | 8.8 | 2023-07-17 | A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users witho… |
CVE-2023-31704 | Critical | 9.8 | 2023-07-13 | Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the admin… |
CVE-2023-3444 | Medium | 5.7 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-2576 | Medium | 4.3 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-21256 | High | 7.8 | 2023-07-13 | In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to loca… |
CVE-2023-21254 | High | 7.8 | 2023-07-13 | In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic erro… |
CVE-2023-21245 | High | 7.8 | 2023-07-13 | In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a l… |
CVE-2023-37579 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0… |
CVE-2023-35908 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgra… |
CVE-2023-30429 | Critical | 9.6 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client… |
CVE-2023-30428 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to… |
CVE-2023-36994 | Critical | 9.8 | 2023-07-07 | In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code. |
CVE-2023-34197 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerabili… |
CVE-2023-36829 | Medium | 6.8 | 2023-07-06 | Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the… |
CVE-2023-29381 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and… |
CVE-2022-48508 | High | 7.5 | 2023-07-06 | Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-29656 | Medium | 6.1 | 2023-07-06 | An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control "antigena"… |
CVE-2022-46080 | Critical | 9.8 | 2023-07-06 | Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET. |
CVE-2023-35939 | High | 8.1 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file access… |
CVE-2023-34107 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a o… |
CVE-2023-34106 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on… |
CVE-2021-46891 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2021-46890 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-26258 | Critical | 9.8 | 2023-07-03 | Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. Thi… |
CVE-2023-31997 | Critical | 9.0 | 2023-07-01 | UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2023-37300 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hi… |
CVE-2023-33190 | Critical | 9.9 | 2023-06-29 | Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration… |
CVE-2023-30955 | Medium | 4.3 | 2023-06-29 | A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'… |
CVE-2023-21225 | High | 7.8 | 2023-06-28 | there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with… |
CVE-2023-22593 | Medium | 4.0 | 2023-06-27 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis contain… |
CVE-2021-30205 | Medium | 5.3 | 2023-06-27 | Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments a… |
CVE-2023-34148 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34147 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34146 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-35165 | Medium | 6.6 | 2023-06-23 | AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudF… |
CVE-2023-32353 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges. |
CVE-2023-3114 | Medium | 5.0 | 2023-06-22 | Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agen… |
CVE-2023-34923 | High | 8.1 | 2023-06-22 | XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Pro… |
CVE-2023-29708 | High | 7.5 | 2023-06-22 | An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload. |
CVE-2023-0971 | Critical | 9.6 | 2023-06-21 | A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encry… |
CVE-2023-35166 | Critical | 9.9 | 2023-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the rig… |
CVE-2023-34161 | High | 7.5 | 2023-06-19 | nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2022-48495 | Medium | 5.3 | 2023-06-19 | Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obt… |
CVE-2022-48488 | Medium | 5.3 | 2023-06-19 | Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desk… |
CVE-2023-35866 | Medium | 5.5 | 2023-06-19 | In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, wi… |
CVE-2023-25185 | Low | 3.8 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software… |
CVE-2023-29296 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29295 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29288 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-22248 | High | 7.5 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-28175 | High | 7.1 | 2023-06-15 | Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal n… |
CVE-2022-22307 | Medium | 4.4 | 2023-06-15 | IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 2167… |
CVE-2022-31646 | High | 7.8 | 2023-06-14 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2022-31644 | High | 7.8 | 2023-06-14 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2023-32061 | Medium | 5.4 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2023-34965 | Medium | 5.3 | 2023-06-13 | SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information. |
CVE-2023-32220 | High | 8.2 | 2023-06-12 | Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. |
CVE-2023-32219 | Medium | 6.5 | 2023-06-12 | A Mazda model (2015-2016) can be unlocked via an unspecified method. |
CVE-2023-27716 | Critical | 9.8 | 2023-06-12 | An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it. |
CVE-2023-29766 | High | 7.8 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files. |
CVE-2023-29761 | Medium | 5.5 | 2023-06-09 | An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-29759 | Medium | 5.5 | 2023-06-09 | An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files. |
CVE-2023-29758 | Medium | 5.5 | 2023-06-09 | An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference f… |
CVE-2023-29752 | High | 7.8 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component. |
CVE-2023-32749 | High | 8.8 | 2023-06-08 | Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such… |
CVE-2023-34958 | Medium | 4.3 | 2023-06-08 | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if th… |
CVE-2021-4352 | Medium | 5.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in ver… |
CVE-2020-36710 | Medium | 5.3 | 2023-06-07 | The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it po… |
CVE-2023-33651 | High | 7.5 | 2023-06-06 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0… |
CVE-2023-32683 | Low | 3.5 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklis… |
CVE-2023-22833 | High | 7.6 | 2023-06-06 | Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organiz… |
CVE-2023-1779 | Medium | 4.3 | 2023-06-06 | Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtu… |
CVE-2023-21670 | High | 7.8 | 2023-06-06 | Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode. |
CVE-2022-40529 | High | 7.1 | 2023-06-06 | Memory corruption due to improper access control in kernel while processing a mapping request from root process. |
CVE-2023-3027 | High | 7.8 | 2023-06-05 | The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead… |
CVE-2023-3066 | High | 8.1 | 2023-06-05 | Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administrators… |
CVE-2023-25749 | Medium | 4.3 | 2023-06-02 | Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now con… |
CVE-2023-25729 | High | 8.8 | 2023-06-02 | Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user… |
CVE-2023-23604 | Medium | 6.5 | 2023-06-02 | A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to byp… |
CVE-2023-3033 | Medium | 6.8 | 2023-06-02 | Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2023-28698 | Critical | 9.8 | 2023-06-02 | Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying… |
CVE-2022-46308 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit thi… |
CVE-2022-46307 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vul… |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |