CWE-863 · Incorrect Authorization (page 23)
Page 23 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21540 | Medium | 5.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21539 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is… |
CVE-2025-21537 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affec… |
CVE-2025-21533 | Medium | 5.5 | 2025-01-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and pr… |
CVE-2025-21519 | Medium | 4.4 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-21517 | Medium | 4.3 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-21516 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.5-12… |
CVE-2025-21506 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are… |
CVE-2025-21502 | Medium | 4.8 | 2025-01-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-51417 | Medium | 6.4 | 2025-01-21 | An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. |
CVE-2025-24460 | Medium | 4.3 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool |
CVE-2025-0580 | Medium | 5.6 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-57032 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is poss… |
CVE-2024-53553 | Critical | 9.1 | 2025-01-16 | An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. |
CVE-2024-57683 | Medium | 4.3 | 2025-01-16 | An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter setti… |
CVE-2024-57681 | Medium | 5.3 | 2025-01-16 | An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the… |
CVE-2024-57680 | Medium | 5.3 | 2025-01-16 | An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port tri… |
CVE-2024-57679 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and… |
CVE-2024-57678 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac ac… |
CVE-2024-57677 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the… |
CVE-2024-57676 | Medium | 6.5 | 2025-01-16 | An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and… |
CVE-2024-44136 | Medium | 4.6 | 2025-01-15 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to a device may b… |
CVE-2024-40771 | High | 7.8 | 2025-01-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
CVE-2025-21403 | Medium | 6.4 | 2025-01-14 | On-Premises Data Gateway Information Disclosure Vulnerability |
CVE-2024-13302 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 befor… |
CVE-2024-13291 | High | 7.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 b… |
CVE-2024-13290 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4. |
CVE-2024-56114 | Medium | 6.5 | 2025-01-09 | Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authori… |
CVE-2024-13282 | High | 8.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0. |
CVE-2024-13281 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2. |
CVE-2024-13278 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0. |
CVE-2024-13277 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1. |
CVE-2024-13271 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4. |
CVE-2024-13270 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1. |
CVE-2024-13266 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from… |
CVE-2024-13258 | Critical | 9.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authen… |
CVE-2024-13257 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0… |
CVE-2024-13253 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notificat… |
CVE-2025-22449 | Low | 3.8 | 2025-01-09 | Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2025-0237 | Medium | 5.4 | 2025-01-07 | The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal bein… |
CVE-2024-39025 | High | 7.5 | 2024-12-27 | Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data. |
CVE-2020-9081 | Low | 3.5 | 2024-12-27 | There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this v… |
CVE-2024-47157 | Low | 2.9 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-47148 | Medium | 4.0 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-56431 | Critical | 9.8 | 2024-12-25 | oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because… |
CVE-2024-47102 | Medium | 5.5 | 2024-12-25 | IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial… |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-12831 | High | 7.8 | 2024-12-20 | Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2023-4617 | Critical | 10.0 | 2024-12-19 | Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other… |
CVE-2024-12539 | Medium | 6.5 | 2024-12-17 | An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security… |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-54662 | Critical | 9.1 | 2024-12-17 | Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. |
CVE-2024-9654 | Low | 3.7 | 2024-12-17 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient vali… |
CVE-2024-37775 | High | 7.5 | 2024-12-16 | Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check. |
CVE-2024-8650 | Medium | 5.3 | 2024-12-16 | An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-membe… |
CVE-2024-8116 | Medium | 5.3 | 2024-12-16 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific Gr… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-10043 | Low | 3.1 | 2024-12-12 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions s… |
CVE-2024-54495 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected… |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-55579 | High | 8.8 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection… |
CVE-2024-12247 | Medium | 4.6 | 2024-12-05 | Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a… |
CVE-2024-12196 | Medium | 6.5 | 2024-12-04 | Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of a… |
CVE-2024-12148 | Medium | 4.3 | 2024-12-04 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting e… |
CVE-2023-52944 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authentic… |
CVE-2023-52943 | Medium | 4.3 | 2024-12-04 | Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authen… |
CVE-2024-45204 | Medium | 4.3 | 2024-12-04 | A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The ex… |
CVE-2024-42452 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escala… |
CVE-2024-42451 | Medium | 6.5 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of m… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-53937 | High | 8.8 | 2024-12-02 | An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default with ad… |
CVE-2024-53941 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote attacker (in proximity to a Wi-Fi netwo… |
CVE-2024-52732 | Critical | 9.1 | 2024-12-02 | Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. |
CVE-2024-36611 | High | 7.5 | 2024-11-29 | In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the usernam… |
CVE-2024-48651 | High | 7.5 | 2024-11-29 | In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_… |
CVE-2024-54124 | High | 8.8 | 2024-11-29 | In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen. |
CVE-2018-9374 | High | 7.8 | 2024-11-28 | In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with User execution… |
CVE-2024-11669 | Medium | 6.5 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints cou… |
CVE-2024-50671 | Medium | 4.3 | 2024-11-25 | Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get… |
CVE-2024-7915 | High | 7.8 | 2024-11-25 | The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. T… |
CVE-2024-11672 | Medium | 4.3 | 2024-11-25 | Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciou… |
CVE-2024-11670 | Medium | 5.4 | 2024-11-25 | Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authen… |
CVE-2024-11176 | | 2024-11-20 | Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluat… | |
CVE-2023-21270 | High | 7.8 | 2024-11-19 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect… |
CVE-2024-21287 | High | 7.5 | 2024-11-18 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported versio… |
CVE-2024-52584 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit t… |
CVE-2024-48901 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit th… |
CVE-2024-48897 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-50650 | High | 7.5 | 2024-11-15 | python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the… |
CVE-2024-50647 | High | 7.5 | 2024-11-15 | The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through… |
CVE-2024-31695 | Critical | 9.8 | 2024-11-14 | A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding… |
CVE-2024-3379 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for project… |
CVE-2022-31671 | High | 7.4 | 2024-11-14 | Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attemp… |
CVE-2022-31670 | High | 7.7 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that bel… |
CVE-2022-31669 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id th… |
CVE-2022-31668 | High | 7.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs t… |