CWE-863 · Incorrect Authorization (page 24)
Page 24 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28352 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Stu… |
CVE-2023-24600 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book. |
CVE-2023-33779 | High | 8.8 | 2023-05-26 | A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request… |
CVE-2023-31226 | High | 7.5 | 2023-05-26 | The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-2002 | Medium | 6.8 | 2023-05-26 | A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows… |
CVE-2023-1158 | Medium | 4.3 | 2023-05-24 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of t… |
CVE-2023-31726 | High | 7.5 | 2023-05-23 | AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information. |
CVE-2023-23304 | Critical | 9.1 | 2023-05-23 | The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` m… |
CVE-2023-23299 | High | 7.5 | 2023-05-23 | The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious appli… |
CVE-2023-27920 | Medium | 4.3 | 2023-05-23 | Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versi… |
CVE-2023-27388 | Critical | 9.8 | 2023-05-23 | Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the prod… |
CVE-2023-27384 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. |
CVE-2023-25946 | High | 8.8 | 2023-05-23 | Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communi… |
CVE-2023-33254 | Medium | 6.5 | 2023-05-21 | There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privile… |
CVE-2023-26818 | Medium | 5.5 | 2023-05-19 | Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. |
CVE-2023-31597 | Medium | 6.5 | 2023-05-18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers ar… |
CVE-2023-2782 | Medium | 5.5 | 2023-05-18 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38. |
CVE-2023-29927 | Medium | 4.3 | 2023-05-16 | Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a w… |
CVE-2023-21117 | High | 7.8 | 2023-05-15 | In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permiss… |
CVE-2023-21116 | Medium | 6.7 | 2023-05-15 | In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in… |
CVE-2023-23446 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-23445 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-20880 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges… |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2023-29819 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload. |
CVE-2023-29818 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via the default allow… |
CVE-2023-2515 | Medium | 4.7 | 2023-05-12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin |
CVE-2023-28357 | Medium | 4.3 | 2023-05-11 | A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given… |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |
CVE-2022-45128 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2022-43465 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2022-41610 | Medium | 5.0 | 2023-05-10 | Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to p… |
CVE-2023-24932 | Medium | 6.7 | 2023-05-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2023-32069 | Critical | 9.9 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute… |
CVE-2020-23362 | High | 7.1 | 2023-05-09 | Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter. |
CVE-2023-32060 | Medium | 6.5 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13… |
CVE-2023-31138 | High | 7.1 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1… |
CVE-2023-31141 | Medium | 4.8 | 2023-05-08 | OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the… |
CVE-2023-24505 | Medium | 5.3 | 2023-05-08 | Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. |
CVE-2023-27954 | Medium | 6.5 | 2023-05-08 | The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS… |
CVE-2023-27951 | Medium | 5.5 | 2023-05-08 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to… |
CVE-2023-23538 | Medium | 5.5 | 2023-05-08 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to modify protected part… |
CVE-2023-30840 | Medium | 5.8 | 2023-05-08 | Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior… |
CVE-2023-1979 | Medium | 4.9 | 2023-05-08 | The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible t… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-29240 | Medium | 5.4 | 2023-05-03 | An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software… |
CVE-2023-31435 | High | 8.1 | 2023-05-02 | Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 228… |
CVE-2022-47874 | Medium | 6.5 | 2023-05-02 | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox… |
CVE-2023-30024 | Medium | 6.6 | 2023-04-28 | The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attacker… |
CVE-2023-30467 | High | 7.5 | 2023-04-28 | This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper au… |
CVE-2022-25091 | Medium | 5.3 | 2023-04-27 | Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the… |
CVE-2022-37326 | High | 7.8 | 2023-04-27 | Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling… |
CVE-2023-26246 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26245 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26244 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used durin… |
CVE-2023-27107 | High | 8.8 | 2023-04-26 | Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do… |
CVE-2023-31250 | Medium | 6.5 | 2023-04-26 | The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they s… |
CVE-2022-25274 | Medium | 5.4 | 2023-04-26 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting i… |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2023-20871 | High | 7.8 | 2023-04-25 | VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges… |
CVE-2021-44465 | Medium | 4.3 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future n… |
CVE-2021-23203 | High | 7.5 | 2023-04-25 | Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF… |
CVE-2023-2257 | High | 7.8 | 2023-04-24 | Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access t… |
CVE-2023-26097 | High | 8.4 | 2023-04-24 | An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked. |
CVE-2023-30544 | Low | 3.9 | 2023-04-24 | Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile… |
CVE-2023-20950 | High | 7.8 | 2023-04-19 | In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch restrictions via a pendingIntent. This could… |
CVE-2023-25548 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured whe… |
CVE-2023-25547 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low pri… |
CVE-2023-2020 | Medium | 4.3 | 2023-04-18 | Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. |
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2020-17354 | High | 8.6 | 2023-04-15 | LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme… |
CVE-2023-22620 | High | 7.5 | 2023-04-12 | An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authen… |
CVE-2023-28270 | Medium | 6.8 | 2023-04-11 | Windows Lock Screen Security Feature Bypass Vulnerability |
CVE-2023-28249 | Medium | 6.2 | 2023-04-11 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-25415 | Medium | 5.3 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Event Notification configuration. |
CVE-2022-40682 | High | 7.8 | 2023-04-11 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauth… |
CVE-2022-43770 | Medium | 5.4 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashb… |
CVE-2023-1417 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possibl… |
CVE-2023-1071 | Low | 3.1 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fro… |
CVE-2023-0319 | Medium | 5.8 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions sta… |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2022-43940 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the… |
CVE-2023-1603 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted righ… |
CVE-2023-1202 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with r… |
CVE-2023-23594 | Critical | 9.8 | 2023-03-31 | An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated… |
CVE-2023-26829 | Critical | 9.8 | 2023-03-31 | An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password f… |
CVE-2022-27642 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentic… |
CVE-2023-22251 | Medium | 4.3 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authentica… |
CVE-2023-1144 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Ga… |
CVE-2023-1136 | Critical | 9.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentica… |
CVE-2023-25017 | High | 8.1 | 2023-03-27 | RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific p… |
CVE-2023-21035 | High | 7.8 | 2023-03-24 | In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name… |
CVE-2023-21034 | High | 7.8 | 2023-03-24 | In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation… |
CVE-2023-20975 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_CONTENT_CAPTURE due to a permissions bypa… |
CVE-2023-20971 | High | 7.8 | 2023-03-24 | In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in… |
CVE-2023-28611 | Critical | 9.8 | 2023-03-23 | Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions. |
CVE-2023-23192 | High | 7.2 | 2023-03-23 | IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task. |
CVE-2023-25924 | Medium | 5.4 | 2023-03-22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have acce… |
CVE-2023-25594 | Medium | 6.3 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change… |