CWE-863 · Incorrect Authorization (page 25)
Page 25 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25923 | Low | 2.7 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service a… |
CVE-2023-27578 | Critical | 9.1 | 2023-03-20 | Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insuffici… |
CVE-2023-0940 | High | 8.8 | 2023-03-20 | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows… |
CVE-2023-27594 | Medium | 4.2 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific condit… |
CVE-2023-26484 | High | 8.2 | 2023-03-15 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-h… |
CVE-2023-24880 | Medium | 4.4 | 2023-03-14 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2022-39214 | Critical | 9.6 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take ov… |
CVE-2023-24999 | Medium | 4.4 | 2023-03-11 | HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID o… |
CVE-2023-27903 | Medium | 4.4 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27899 | High | 7.0 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2022-4315 | Medium | 5.0 | 2023-03-08 | An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every requ… |
CVE-2023-22891 | High | 8.1 | 2023-03-08 | There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords… |
CVE-2023-27486 | High | 8.1 | 2023-03-08 | xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters… |
CVE-2023-27485 | Medium | 4.3 | 2023-03-07 | thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` f… |
CVE-2023-0328 | Medium | 4.3 | 2023-03-06 | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to a… |
CVE-2023-1164 | High | 8.4 | 2023-03-03 | A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the comp… |
CVE-2023-26056 | Medium | 5.4 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the… |
CVE-2023-0952 | Medium | 6.5 | 2023-03-01 | Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper aut… |
CVE-2023-25575 | High | 7.7 | 2023-02-28 | API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatf… |
CVE-2023-23510 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a user’s Safari history. |
CVE-2023-23506 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access user-sensitive data. |
CVE-2022-46704 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may… |
CVE-2023-23918 | High | 7.5 | 2023-02-23 | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (h… |
CVE-2023-23064 | Critical | 9.8 | 2023-02-17 | TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control. |
CVE-2021-32163 | Critical | 9.8 | 2023-02-17 | Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. |
CVE-2023-24485 | High | 7.8 | 2023-02-16 | Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace… |
CVE-2023-23947 | Critical | 9.1 | 2023-02-16 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and… |
CVE-2023-25173 | Medium | 5.3 | 2023-02-16 | containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up pro… |
CVE-2023-21715 | High | 7.3 | 2023-02-14 | Microsoft Publisher Security Feature Bypass Vulnerability |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2022-34397 | Medium | 6.9 | 2023-02-13 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, all… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |
CVE-2023-21423 | Medium | 5.1 | 2023-02-09 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unp… |
CVE-2023-21422 | Medium | 5.7 | 2023-02-09 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without per… |
CVE-2022-45544 | High | 8.8 | 2023-02-07 | Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao par… |
CVE-2023-23696 | High | 7.0 | 2023-02-07 | Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could p… |
CVE-2023-24029 | High | 7.2 | 2023-02-03 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient… |
CVE-2023-23751 | Medium | 4.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. |
CVE-2022-47002 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request. |
CVE-2023-23924 | Critical | 10.0 | 2023-02-01 | Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This ma… |
CVE-2022-45172 | Critical | 9.8 | 2023-01-31 | An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the… |
CVE-2023-22610 | Critical | 9.1 | 2023-01-31 | A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the… |
CVE-2022-45435 | Medium | 6.8 | 2023-01-31 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2023-22500 | High | 7.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerabili… |
CVE-2023-22482 | Critical | 9.0 | 2023-01-26 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6… |
CVE-2023-21719 | Medium | 6.5 | 2023-01-24 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2022-23739 | Critical | 9.8 | 2023-01-17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub… |
CVE-2022-45353 | Medium | 4.3 | 2023-01-14 | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. |
CVE-2023-0298 | Medium | 6.5 | 2023-01-14 | Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-0091 | Low | 3.8 | 2023-01-13 | A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker… |
CVE-2022-2155 | Medium | 5.7 | 2023-01-12 | A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limi… |
CVE-2022-4167 | Medium | 5.3 | 2023-01-12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group acces… |
CVE-2023-22945 | Medium | 4.3 | 2023-01-11 | In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll a… |
CVE-2023-21560 | Medium | 6.6 | 2023-01-10 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-0133 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permis… |
CVE-2015-10033 | Low | 3.5 | 2023-01-09 | A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipu… |
CVE-2022-46258 | Medium | 6.5 | 2023-01-09 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Act… |
CVE-2022-43438 | High | 8.8 | 2023-01-03 | The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnera… |
CVE-2022-23553 | High | 7.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are… |
CVE-2021-45466 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_ke… |
CVE-2022-45891 | Critical | 9.1 | 2022-12-25 | Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access content uploaded b… |
CVE-2022-38475 | Medium | 6.5 | 2022-12-22 | An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to… |
CVE-2022-22754 | Medium | 6.5 | 2022-12-22 | If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new… |
CVE-2020-36625 | Medium | 4.3 | 2022-12-22 | A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The man… |
CVE-2022-3188 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication an… |
CVE-2021-4275 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cros… |
CVE-2022-23551 | Medium | 5.3 | 2022-12-21 | aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in A… |
CVE-2021-4268 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-si… |
CVE-2020-36623 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The ma… |
CVE-2020-36622 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site… |
CVE-2022-43872 | Medium | 5.3 | 2022-12-20 | IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical informati… |
CVE-2022-46076 | High | 7.5 | 2022-12-20 | D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi. |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2022-23490 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetin… |
CVE-2022-42351 | Medium | 4.3 | 2022-12-16 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A… |
CVE-2022-20558 | Low | 3.3 | 2022-12-16 | In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to loc… |
CVE-2022-41962 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status… |
CVE-2022-23741 | High | 7.2 | 2022-12-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner… |
CVE-2022-46160 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations… |
CVE-2022-23473 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not prope… |
CVE-2022-41274 | Medium | 6.5 | 2022-12-13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These… |
CVE-2022-3883 | Medium | 6.5 | 2022-12-12 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in… |
CVE-2022-3882 | Medium | 6.5 | 2022-12-12 | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in a… |
CVE-2022-3881 | Medium | 5.7 | 2022-12-12 | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not… |
CVE-2022-3880 | Medium | 6.5 | 2022-12-12 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation… |
CVE-2022-3879 | Medium | 6.5 | 2022-12-12 | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allo… |
CVE-2022-45956 | Medium | 5.3 | 2022-12-12 | Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic… |
CVE-2022-45760 | High | 8.8 | 2022-12-12 | SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. |
CVE-2022-4397 | Medium | 4.3 | 2022-12-10 | A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/C… |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2020-36610 | Medium | 4.3 | 2022-12-08 | A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2022-4349 | Medium | 4.3 | 2022-12-08 | A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cro… |
CVE-2022-46792 | High | 8.8 | 2022-12-08 | Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |