CWE-863 · Incorrect Authorization (page 26)
Page 26 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44039 | Critical | 9.8 | 2022-12-05 | Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrit… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-46167 | High | 8.8 | 2022-12-02 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted wit… |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-24189 | Medium | 6.5 | 2022-11-28 | The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests t… |
CVE-2022-41944 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain con… |
CVE-2022-4090 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.ph… |
CVE-2022-41923 | Critical | 9.1 | 2022-11-23 | Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoi… |
CVE-2022-36785 | High | 7.5 | 2022-11-17 | D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15… |
CVE-2022-4014 | Medium | 4.3 | 2022-11-16 | A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My… |
CVE-2022-4013 | Medium | 4.3 | 2022-11-16 | A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appoi… |
CVE-2022-41918 | Medium | 6.3 | 2022-11-15 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules… |
CVE-2022-20928 | Medium | 5.8 | 2022-11-15 | A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defe… |
CVE-2022-45383 | Medium | 6.5 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downlo… |
CVE-2022-42978 | High | 7.5 | 2022-11-15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remot… |
CVE-2022-39385 | Medium | 6.5 | 2022-11-14 | Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-39388 | High | 7.6 | 2022-11-10 | Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload i… |
CVE-2022-3819 | Low | 3.5 | 2022-11-10 | An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malic… |
CVE-2022-41091 | Medium | 5.4 | 2022-11-09 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2022-39352 | Medium | 4.8 | 2022-11-08 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under… |
CVE-2022-20942 | Medium | 6.5 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Applian… |
CVE-2022-42788 | Medium | 5.5 | 2022-11-01 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may… |
CVE-2022-39322 | Critical | 9.1 | 2022-10-25 | @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who e… |
CVE-2022-42344 | High | 8.8 | 2022-10-20 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An aut… |
CVE-2022-3585 | Medium | 4.3 | 2022-10-18 | A vulnerability classified as problematic has been found in SourceCodester Simple Cold Storage Management System 1.0. Affected is an unknown function of the fi… |
CVE-2022-3582 | Medium | 4.3 | 2022-10-18 | A vulnerability has been found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2022-42975 | High | 7.5 | 2022-10-17 | socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence… |
CVE-2022-39302 | Medium | 5.5 | 2022-10-14 | Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel fr… |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-41574 | High | 7.5 | 2022-10-07 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with ar… |
CVE-2022-36634 | High | 8.8 | 2022-10-07 | An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-31252 | Medium | 4.4 | 2022-10-06 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did… |
CVE-2021-40692 | Medium | 4.3 | 2022-09-29 | Insufficient capability checks made it possible for teachers to download users outside of their courses. |
CVE-2022-39031 | Medium | 5.3 | 2022-09-28 | Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Sessi… |
CVE-2022-39030 | High | 7.5 | 2022-09-28 | smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to acces… |
CVE-2022-39029 | Medium | 6.5 | 2022-09-28 | Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to… |
CVE-2022-40816 | Medium | 6.5 | 2022-09-27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal… |
CVE-2022-3048 | Medium | 6.8 | 2022-09-26 | Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigat… |
CVE-2022-3024 | Medium | 5.4 | 2022-09-26 | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as… |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2022-0143 | Critical | 9.3 | 2022-09-19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to… |
CVE-2022-36074 | Medium | 6.4 | 2022-09-15 | Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Au… |
CVE-2022-36103 | High | 7.2 | 2022-09-13 | Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improp… |
CVE-2022-2990 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modificat… |
CVE-2022-2989 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modificati… |
CVE-2022-37767 | Critical | 9.8 | 2022-09-12 | Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this… |
CVE-2022-36109 | Medium | 5.3 | 2022-09-09 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are no… |
CVE-2022-23451 | High | 8.1 | 2022-09-06 | An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or d… |
CVE-2022-2597 | Medium | 5.4 | 2022-09-05 | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowin… |
CVE-2022-23452 | Medium | 4.9 | 2022-09-01 | An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an… |
CVE-2022-36051 | High | 8.7 | 2022-08-31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a fe… |
CVE-2021-3563 | High | 7.4 | 2022-08-26 | A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity w… |
CVE-2021-3763 | Medium | 4.3 | 2022-08-23 | A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the ro… |
CVE-2022-35692 | Medium | 5.3 | 2022-08-19 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-36009 | Medium | 5.0 | 2022-08-19 | gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level par… |
CVE-2021-37409 | High | 7.8 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of pri… |
CVE-2022-1401 | Medium | 6.9 | 2022-08-17 | Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker… |
CVE-2022-34255 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2020-14321 | High | 8.8 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. |
CVE-2022-2354 | High | 7.2 | 2022-08-15 | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where… |
CVE-2022-35487 | High | 7.5 | 2022-08-08 | Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an… |
CVE-2022-33718 | Medium | 6.2 | 2022-08-05 | An improper access control vulnerability in Wi-Fi Service prior to SMR AUG-2022 Release 1 allows untrusted applications to manipulate the list of apps that can… |
CVE-2022-2501 | Medium | 5.9 | 2022-08-05 | An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attack… |
CVE-2022-2326 | Medium | 6.4 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2095 | Medium | 4.3 | 2022-08-05 | An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all ve… |
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2022-35924 | Critical | 9.1 | 2022-08-02 | NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions… |
CVE-2022-35921 | Low | 3.5 | 2022-08-01 | fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of By… |
CVE-2022-31190 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affec… |
CVE-2022-31178 | Medium | 4.3 | 2022-08-01 | eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a template without being… |
CVE-2022-31155 | Medium | 4.3 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ sa… |
CVE-2022-31154 | Medium | 6.4 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any oth… |
CVE-2022-35716 | Medium | 6.5 | 2022-08-01 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticate… |
CVE-2022-22326 | Low | 3.3 | 2022-08-01 | IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and fil… |
CVE-2022-1499 | Medium | 6.3 | 2022-07-26 | Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2022-1309 | Critical | 9.6 | 2022-07-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2022-0670 | Critical | 9.1 | 2022-07-25 | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vul… |
CVE-2022-0594 | Medium | 5.3 | 2022-07-25 | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action… |
CVE-2022-1132 | Medium | 6.1 | 2022-07-23 | Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restriction… |
CVE-2022-31168 | Medium | 5.4 | 2022-07-22 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API… |
CVE-2022-34046 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtm… |
CVE-2022-26479 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor) causes all API ca… |
CVE-2022-36126 | High | 7.2 | 2022-07-16 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbi… |
CVE-2022-35890 | Critical | 9.8 | 2022-07-15 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacke… |
CVE-2022-31153 | Medium | 6.5 | 2022-07-15 | OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to… |
CVE-2022-31107 | High | 7.1 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious use… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-30203 | High | 7.4 | 2022-07-12 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2022-29619 | Medium | 6.5 | 2022-07-12 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of… |
CVE-2022-31139 | Medium | 5.9 | 2022-07-11 | UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is p… |
CVE-2022-32294 | Critical | 9.8 | 2022-07-11 | Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartex… |
CVE-2022-32290 | Medium | 4.3 | 2022-07-06 | The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP prox… |
CVE-2022-32310 | Critical | 9.8 | 2022-07-05 | An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/User… |
CVE-2022-1981 | Low | 2.7 | 2022-07-01 | An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab… |
CVE-2022-1983 | Medium | 6.5 | 2022-07-01 | Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker alr… |
CVE-2022-34814 | Medium | 4.3 | 2022-06-30 | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re… |