CWE-863 · Incorrect Authorization (page 27)
Page 27 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23262 | Low | 3.3 | 2024-03-08 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, visionOS 1.1. An ap… |
CVE-2024-23255 | Low | 2.4 | 2024-03-08 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Photos in the Hidden… |
CVE-2024-23250 | Medium | 5.5 | 2024-03-08 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A… |
CVE-2024-28229 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles |
CVE-2024-0199 | High | 7.7 | 2024-03-07 | An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An… |
CVE-2024-27915 | Medium | 6.8 | 2024-03-06 | Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permiss… |
CVE-2024-27288 | Medium | 6.3 | 2024-03-06 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access… |
CVE-2024-24761 | High | 7.5 | 2024-03-06 | Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per def… |
CVE-2024-28174 | Medium | 5.8 | 2024-03-06 | In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2023-47716 | Medium | 6.3 | 2024-03-01 | IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumsta… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-25170 | Critical | 9.1 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. |
CVE-2024-26016 | Medium | 4.3 | 2024-02-28 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ow… |
CVE-2024-24779 | Medium | 5.0 | 2024-02-28 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to d… |
CVE-2024-24773 | Medium | 4.9 | 2024-02-28 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Supers… |
CVE-2023-3509 | Low | 3.7 | 2024-02-21 | An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 bef… |
CVE-2024-26145 | Medium | 6.5 | 2024-02-21 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private… |
CVE-2023-46241 | Critical | 9.0 | 2024-02-21 | `discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enabled, an attack can po… |
CVE-2023-42860 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app m… |
CVE-2024-1156 | High | 7.8 | 2024-02-20 | Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentia… |
CVE-2024-1155 | High | 7.8 | 2024-02-20 | Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalat… |
CVE-2024-25604 | Medium | 6.5 | 2024-02-20 | Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsu… |
CVE-2024-25149 | Medium | 5.4 | 2024-02-20 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported ve… |
CVE-2023-52374 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the package management module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52361 | High | 7.5 | 2024-02-18 | The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity. |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |
CVE-2024-0017 | Medium | 5.5 | 2024-02-16 | In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosu… |
CVE-2024-1482 | High | 7.1 | 2024-02-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and… |
CVE-2024-24966 | Medium | 6.2 | 2024-02-14 | When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which h… |
CVE-2023-6152 | Medium | 5.4 | 2024-02-13 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_e… |
CVE-2024-24751 | Medium | 4.3 | 2024-02-13 | sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control c… |
CVE-2024-23833 | High | 7.5 | 2024-02-12 | OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) whe… |
CVE-2024-25108 | Critical | 9.9 | 2024-02-12 | Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce… |
CVE-2023-6036 | Critical | 9.8 | 2024-02-12 | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handl… |
CVE-2024-24774 | Low | 3.4 | 2024-02-09 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription… |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2023-43609 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause… |
CVE-2023-6564 | Medium | 6.5 | 2024-02-08 | An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can pus… |
CVE-2024-24824 | High | 8.8 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and insta… |
CVE-2024-20828 | Low | 2.4 | 2024-02-06 | Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode… |
CVE-2023-6963 | Medium | 5.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthen… |
CVE-2024-22208 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticat… |
CVE-2023-32967 | Medium | 5.0 | 2024-02-02 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-47142 | High | 7.5 | 2024-02-02 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their priv… |
CVE-2024-24573 | High | 8.8 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request… |
CVE-2024-23653 | Critical | 9.8 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as bui… |
CVE-2024-22938 | High | 7.8 | 2024-01-30 | Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin… |
CVE-2024-23629 | Critical | 9.6 | 2024-01-26 | An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs… |
CVE-2023-35836 | Medium | 6.5 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the de… |
CVE-2023-49783 | Medium | 4.3 | 2024-01-23 | Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch p… |
CVE-2023-44401 | Medium | 5.3 | 2024-01-23 | The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` p… |
CVE-2024-23675 | Medium | 6.5 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST applicati… |
CVE-2024-23329 | Low | 3.7 | 2024-01-19 | changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/histor… |
CVE-2022-0775 | Medium | 4.3 | 2024-01-16 | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such a… |
CVE-2023-52111 | High | 7.5 | 2024-01-16 | Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-5356 | High | 7.3 | 2024-01-12 | Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions… |
CVE-2023-4812 | High | 7.6 | 2024-01-12 | An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions… |
CVE-2023-41994 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the camera view from apps oth… |
CVE-2024-21736 | Medium | 6.4 | 2024-01-09 | SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import c… |
CVE-2024-21735 | High | 7.3 | 2024-01-09 | SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. Th… |
CVE-2023-46906 | Medium | 4.9 | 2024-01-09 | juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field wa… |
CVE-2023-41779 | Medium | 4.4 | 2024-01-03 | There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permissio… |
CVE-2023-52077 | High | 8.9 | 2023-12-27 | Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by… |
CVE-2023-5644 | High | 7.6 | 2023-12-26 | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete… |
CVE-2023-49949 | High | 8.1 | 2023-12-26 | Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. |
CVE-2023-51649 | Low | 3.5 | 2023-12-22 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL da… |
CVE-2022-39337 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1… |
CVE-2023-51380 | Low | 2.7 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. Thi… |
CVE-2023-51379 | Medium | 4.9 | 2023-12-21 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token… |
CVE-2023-50732 | High | 8.3 | 2023-12-21 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without scr… |
CVE-2023-7047 | Medium | 4.4 | 2023-12-21 | Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31… |
CVE-2023-50705 | Medium | 5.3 | 2023-12-20 | An attacker could create malicious requests to obtain sensitive information about the web server. |
CVE-2023-49734 | High | 7.7 | 2023-12-19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts al… |
CVE-2023-6355 | Medium | 6.8 | 2023-12-18 | Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue… |
CVE-2023-41314 | High | 8.2 | 2023-12-18 | The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade… |
CVE-2023-3511 | Low | 2.0 | 2023-12-15 | An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions… |
CVE-2023-6837 | High | 8.5 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any imp… |
CVE-2023-45185 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-47320 | High | 8.1 | 2023-12-13 | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting… |
CVE-2023-49273 | Medium | 5.4 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (… |
CVE-2023-48227 | Medium | 4.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send… |
CVE-2020-10676 | High | 8.8 | 2023-12-12 | In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move tha… |
CVE-2023-6542 | High | 7.1 | 2023-12-12 | Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep… |
CVE-2023-36646 | High | 8.8 | 2023-12-12 | Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged… |
CVE-2023-50457 | Medium | 4.3 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see… |
CVE-2023-48859 | High | 8.8 | 2023-12-06 | TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security rest… |
CVE-2023-49246 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49240 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-49239 | High | 7.5 | 2023-12-06 | Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-42575 | Medium | 5.4 | 2023-12-05 | Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid flag setting. |
CVE-2023-42569 | Medium | 4.0 | 2023-12-05 | Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji. |
CVE-2023-33071 | High | 8.4 | 2023-12-05 | Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities. |
CVE-2023-24052 | Critical | 9.8 | 2023-12-04 | An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not… |
CVE-2023-24051 | Critical | 9.8 | 2023-12-04 | A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks. |
CVE-2023-24047 | Medium | 6.8 | 2023-12-04 | An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashin… |
CVE-2023-49947 | High | 7.5 | 2023-12-03 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. |
CVE-2023-42006 | High | 8.4 | 2023-12-01 | IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks. I… |