CWE-863 · Incorrect Authorization (page 24)
Page 24 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31667 | Medium | 6.4 | 2024-11-14 | Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By… |
CVE-2024-9693 | High | 8.5 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 p… |
CVE-2024-45877 | Medium | 6.5 | 2024-11-13 | baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This al… |
CVE-2024-8001 | Medium | 5.3 | 2024-11-13 | A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulati… |
CVE-2024-50310 | High | 7.5 | 2024-11-12 | A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions >= V4.0.44 < V4.0.50). Affected devices do not properly handle… |
CVE-2024-43433 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. |
CVE-2024-42000 | Low | 2.7 | 2024-11-09 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which… |
CVE-2024-52314 | Medium | 4.9 | 2024-11-09 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applica… |
CVE-2024-52312 | Medium | 5.4 | 2024-11-09 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against Data… |
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |
CVE-2024-44765 | Medium | 6.5 | 2024-11-08 | An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass… |
CVE-2024-10975 | High | 7.7 | 2024-11-07 | Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container S… |
CVE-2024-20537 | Medium | 6.5 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-9902 | Medium | 6.3 | 2024-11-06 | A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system… |
CVE-2024-48176 | Critical | 9.8 | 2024-11-05 | Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshe… |
CVE-2024-30616 | High | 8.8 | 2024-11-04 | Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a si… |
CVE-2024-45164 | High | 7.1 | 2024-11-04 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal befor… |
CVE-2024-49256 | Medium | 5.4 | 2024-11-01 | Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2024-49501 | Medium | 5.7 | 2024-11-01 | Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the p… |
CVE-2024-51426 | High | 8.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer f… |
CVE-2024-51425 | High | 8.8 | 2024-10-30 | An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is di… |
CVE-2024-50419 | Medium | 5.4 | 2024-10-30 | Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-48921 | Low | 2.7 | 2024-10-29 | Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a Polic… |
CVE-2024-44217 | Critical | 9.1 | 2024-10-28 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may… |
CVE-2024-44301 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44289 | High | 7.5 | 2024-10-28 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventu… |
CVE-2024-44287 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44270 | High | 8.6 | 2024-10-28 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A sandboxed process… |
CVE-2024-44253 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modif… |
CVE-2024-44247 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may… |
CVE-2024-44196 | Medium | 5.5 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app ma… |
CVE-2024-44137 | Medium | 4.6 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical acc… |
CVE-2024-40855 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app m… |
CVE-2024-9825 | Medium | 5.4 | 2024-10-28 | The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object ref… |
CVE-2024-48936 | Medium | 5.0 | 2024-10-28 | SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under o… |
CVE-2024-48237 | Critical | 9.8 | 2024-10-25 | WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php. |
CVE-2022-30358 | High | 8.8 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters… |
CVE-2022-30356 | Medium | 4.7 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters… |
CVE-2024-49376 | High | 8.8 | 2024-10-25 | Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email… |
CVE-2024-47025 | Medium | 5.5 | 2024-10-25 | In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure w… |
CVE-2024-44099 | Medium | 5.5 | 2024-10-25 | There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execu… |
CVE-2024-41617 | Critical | 9.8 | 2024-10-24 | Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security… |
CVE-2024-45261 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not t… |
CVE-2024-45260 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can in… |
CVE-2024-10295 | High | 7.5 | 2024-10-24 | A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed bas… |
CVE-2024-48548 | Critical | 9.3 | 2024-10-24 | The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitraril… |
CVE-2024-48547 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzin… |
CVE-2024-48546 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48545 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48544 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyz… |
CVE-2024-48542 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information… |
CVE-2024-48541 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing th… |
CVE-2024-48540 | Medium | 6.2 | 2024-10-24 | Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file. |
CVE-2024-20482 | Medium | 6.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-49209 | Medium | 6.5 | 2024-10-22 | Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unpri… |
CVE-2024-49208 | Medium | 5.9 | 2024-10-22 | Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivile… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2024-38002 | Critical | 9.0 | 2024-10-22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through upda… |
CVE-2024-10173 | High | 7.3 | 2024-10-20 | A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console… |
CVE-2024-29821 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-29213 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-20420 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker w… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2024-21285 | High | 7.1 | 2024-10-15 | Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that i… |
CVE-2024-21284 | High | 7.1 | 2024-10-15 | Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The supported version that i… |
CVE-2024-21283 | High | 8.1 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that… |
CVE-2024-21282 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21280 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affected are 12.2.5-12.2… |
CVE-2024-21279 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.13. Easily… |
CVE-2024-21278 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). Supported version… |
CVE-2024-21277 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affe… |
CVE-2024-21276 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). Supported versions that are affected are 12.2.3-12.2.13… |
CVE-2024-21275 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.7-12.2.13. E… |
CVE-2024-21271 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). Supported versions that are affected… |
CVE-2024-21270 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Supported versions that are affected are 12.2… |
CVE-2024-21269 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). Supported versions that are affected are… |
CVE-2024-21268 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.11… |
CVE-2024-21267 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.12-12… |
CVE-2024-21266 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21265 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affected are 12.2.3-12… |
CVE-2024-21262 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily ex… |
CVE-2024-21260 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21259 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and pr… |
CVE-2024-21249 | Medium | 4.3 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Ea… |
CVE-2024-47876 | High | 8.8 | 2024-10-15 | Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a… |
CVE-2024-48911 | High | 7.8 | 2024-10-14 | OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored i… |
CVE-2024-48792 | High | 7.5 | 2024-10-14 | An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48772 | Critical | 9.1 | 2024-10-11 | An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48787 | Critical | 9.1 | 2024-10-11 | An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48786 | Critical | 9.1 | 2024-10-11 | An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48784 | Critical | 9.8 | 2024-10-11 | An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48778 | Critical | 9.1 | 2024-10-11 | An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update pr… |
CVE-2024-48769 | Critical | 9.1 | 2024-10-11 | An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-8970 | High | 8.2 | 2024-10-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-9623 | Medium | 4.9 | 2024-10-10 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-45132 | Medium | 6.5 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privil… |
CVE-2024-45131 | Medium | 5.4 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Secu… |
CVE-2024-45128 | Medium | 5.4 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Secu… |
CVE-2024-45125 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a sec… |
CVE-2024-7048 | Medium | 5.4 | 2024-10-10 | In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. Th… |