CWE-863 · Incorrect Authorization (page 25)
Page 25 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45160 | Critical | 9.1 | 2024-10-09 | Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_pa… |
CVE-2024-47780 | Low | 3.1 | 2024-10-08 | TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointe… |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-47183 | High | 8.1 | 2024-10-04 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is… |
CVE-2024-47616 | Medium | 6.8 | 2024-10-02 | Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state… |
CVE-2024-47560 | High | 7.8 | 2024-10-01 | RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be ex… |
CVE-2024-47172 | Medium | 5.4 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve cert… |
CVE-2024-47077 | Medium | 6.5 | 2024-09-27 | authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that applicati… |
CVE-2024-9136 | Medium | 6.7 | 2024-09-27 | Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-8974 | Low | 2.6 | 2024-09-26 | Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions… |
CVE-2024-9155 | Medium | 4.3 | 2024-09-26 | Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an… |
CVE-2024-7108 | Critical | 9.8 | 2024-09-26 | Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This… |
CVE-2024-20510 | Medium | 4.7 | 2024-09-25 | A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent atta… |
CVE-2024-47078 | High | 8.1 | 2024-09-25 | Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQT… |
CVE-2023-25189 | Low | 3.3 | 2024-09-25 | BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, regardless of the acces… |
CVE-2024-6512 | Medium | 6.5 | 2024-09-25 | Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to ap… |
CVE-2024-6593 | Critical | 9.1 | 2024-09-25 | Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to exec… |
CVE-2024-6592 | Critical | 9.1 | 2024-09-25 | An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and… |
CVE-2024-8606 | High | 8.8 | 2024-09-23 | Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-44162 | High | 7.8 | 2024-09-17 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items. |
CVE-2024-40843 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system. |
CVE-2024-40770 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted… |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-2743 | Medium | 5.3 | 2024-09-12 | An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modif… |
CVE-2024-8691 | High | 7.1 | 2024-09-11 | A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another G… |
CVE-2024-4465 | Medium | 6.0 | 2024-09-11 | An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited p… |
CVE-2024-44667 | High | 8.0 | 2024-09-10 | Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. Unauthenticated… |
CVE-2024-42423 | Medium | 6.1 | 2024-09-10 | Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local… |
CVE-2024-6979 | Medium | 6.8 | 2024-09-10 | Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer account… |
CVE-2024-44114 | Low | 2.0 | 2024-09-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This resu… |
CVE-2024-8601 | Medium | 6.5 | 2024-09-09 | This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated… |
CVE-2024-34652 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage. |
CVE-2024-34651 | Medium | 6.2 | 2024-09-04 | Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files. |
CVE-2024-34650 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel. |
CVE-2024-34642 | Medium | 4.6 | 2024-09-04 | Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information. |
CVE-2024-45588 | High | 8.1 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the app… |
CVE-2024-45587 | High | 8.8 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulner… |
CVE-2024-45586 | High | 8.8 | 2024-09-03 | This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (versio… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-38868 | High | 7.6 | 2024-08-30 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: befor… |
CVE-2024-41964 | High | 8.1 | 2024-08-29 | Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted… |
CVE-2024-43954 | Medium | 6.3 | 2024-08-29 | Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Droip: from n/a throu… |
CVE-2024-45043 | Medium | 5.3 | 2024-08-28 | The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received b… |
CVE-2024-45037 | Medium | 6.4 | 2024-08-27 | The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications… |
CVE-2024-8011 | Medium | 5.5 | 2024-08-25 | Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granted by the user to Op… |
CVE-2024-38869 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Cen… |
CVE-2024-42773 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticat… |
CVE-2024-3127 | Medium | 4.3 | 2024-08-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions… |
CVE-2024-7836 | Medium | 4.3 | 2024-08-22 | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all ver… |
CVE-2024-20466 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-7604 | High | 7.8 | 2024-08-21 | Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication… |
CVE-2024-7711 | Medium | 4.3 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any iss… |
CVE-2024-6337 | Medium | 6.5 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: w… |
CVE-2024-31842 | High | 8.8 | 2024-08-20 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string f… |
CVE-2024-39690 | High | 8.4 | 2024-08-20 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that ha… |
CVE-2024-43250 | High | 7.1 | 2024-08-19 | Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bi… |
CVE-2024-42966 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-7624 | High | 8.1 | 2024-08-15 | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the… |
CVE-2021-26387 | Low | 3.9 | 2024-08-13 | Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions… |
CVE-2024-43131 | High | 7.5 | 2024-08-13 | Incorrect Authorization vulnerability in WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) allows Accessing Functionality Not Properly Constrained… |
CVE-2024-41941 | Medium | 4.3 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could all… |
CVE-2024-41939 | High | 8.8 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could all… |
CVE-2024-42473 | High | 7.5 | 2024-08-12 | OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `… |
CVE-2024-7266 | Medium | 4.3 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users i… |
CVE-2024-7265 | High | 8.8 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the passw… |
CVE-2024-42062 | High | 7.2 | 2024-08-07 | CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised AP… |
CVE-2024-7004 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-6358 | Medium | 6.3 | 2024-08-06 | Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence. |
CVE-2024-6202 | Critical | 9.8 | 2024-08-06 | HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors… |
CVE-2024-6782 | Critical | 9.8 | 2024-08-06 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. |
CVE-2024-40530 | High | 7.5 | 2024-08-05 | A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-Fo… |
CVE-2024-38856 | Critical | 9.8 | 2024-08-05 | Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.1… |
CVE-2024-38884 | High | 7.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authent… |
CVE-2024-6695 | Critical | 9.8 | 2024-07-31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is d… |
CVE-2024-41670 | High | 7.5 | 2024-07-26 | In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer… |
CVE-2024-7062 | High | 8.8 | 2024-07-26 | Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insuffi… |
CVE-2024-4447 | Critical | 9.9 | 2024-07-26 | In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dw… |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-36536 | Critical | 9.8 | 2024-07-24 | Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-41110 | Critical | 9.9 | 2024-07-24 | Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine… |
CVE-2024-31970 | High | 8.8 | 2024-07-24 | AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the… |
CVE-2024-21149 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). Supported versions that are af… |
CVE-2024-5817 | Medium | 6.5 | 2024-07-16 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was onl… |
CVE-2024-5816 | Medium | 5.3 | 2024-07-16 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via… |
CVE-2024-39905 | Medium | 5.3 | 2024-07-11 | Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without… |
CVE-2024-6150 | Medium | 4.3 | 2024-07-10 | A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning |
CVE-2024-39871 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly separate the rights to edi… |
CVE-2024-39696 | High | 8.8 | 2024-07-05 | Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party ac… |
CVE-2024-2231 | Medium | 6.5 | 2024-07-03 | The allows any authenticated user to join a private group due to a missing authorization check on a function |
CVE-2024-39324 | Low | 3.8 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, imp… |
CVE-2024-39322 | Medium | 5.5 | 2024-07-02 | aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024… |
CVE-2024-39323 | High | 7.1 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, a… |
CVE-2024-37905 | High | 8.8 | 2024-06-28 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin… |
CVE-2024-39352 | Medium | 4.9 | 2024-06-28 | A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users with administrator pri… |
CVE-2024-6086 | Medium | 4.3 | 2024-06-27 | In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control… |
CVE-2024-5714 | Medium | 6.8 | 2024-06-27 | In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers i… |