CWE-863 · Incorrect Authorization (page 27)
Page 27 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34785 | Medium | 4.3 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-34782 | Medium | 4.3 | 2022-06-30 | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending re… |
CVE-2022-29271 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an a… |
CVE-2022-32532 | Critical | 9.8 | 2022-06-29 | Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `… |
CVE-2022-31087 | High | 7.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31039 | Medium | 4.3 | 2022-06-27 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are no… |
CVE-2022-1746 | High | 7.6 | 2022-06-24 | The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic… |
CVE-2022-34180 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unpro… |
CVE-2022-22967 | High | 8.8 | 2022-06-23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously author… |
CVE-2017-20066 | Medium | 5.3 | 2022-06-20 | A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to imprope… |
CVE-2022-26668 | High | 7.3 | 2022-06-20 | ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial syst… |
CVE-2022-31589 | Medium | 6.5 | 2022-06-14 | Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authori… |
CVE-2022-27668 | Critical | 9.8 | 2022-06-14 | Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administ… |
CVE-2021-35112 | High | 8.4 | 2022-06-14 | A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon… |
CVE-2022-33174 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the… |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2022-1944 | Medium | 5.4 | 2022-06-06 | When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10… |
CVE-2022-1936 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1935 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1589 | High | 7.5 | 2022-05-30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, wh… |
CVE-2022-26767 | Medium | 5.5 | 2022-05-26 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be ab… |
CVE-2022-30016 | High | 8.8 | 2022-05-23 | Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info. |
CVE-2022-22978 | Critical | 9.8 | 2022-05-19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on… |
CVE-2021-3956 | Medium | 4.3 | 2022-05-18 | A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devic… |
CVE-2022-1706 | Medium | 6.5 | 2022-05-17 | A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only… |
CVE-2022-1753 | Medium | 5.4 | 2022-05-17 | A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The… |
CVE-2022-1553 | Medium | 4.9 | 2022-05-16 | Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vul… |
CVE-2022-0574 | Medium | 6.5 | 2022-05-16 | Improper Access Control in GitHub repository publify/publify prior to 9.2.8. |
CVE-2022-29854 | Medium | 6.8 | 2022-05-13 | A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physica… |
CVE-2022-29218 | High | 7.7 | 2022-05-13 | RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some g… |
CVE-2022-27134 | High | 7.5 | 2022-05-13 | EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryp… |
CVE-2022-23139 | High | 8.8 | 2022-05-12 | ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the ac… |
CVE-2022-24584 | Medium | 6.5 | 2022-05-11 | Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly crea… |
CVE-2022-28774 | Medium | 5.5 | 2022-05-11 | Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. |
CVE-2022-1460 | Medium | 6.1 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions star… |
CVE-2022-1124 | Medium | 4.3 | 2022-05-11 | An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10… |
CVE-2022-28601 | Medium | 6.5 | 2022-05-10 | A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number us… |
CVE-2022-1417 | Medium | 4.3 | 2022-05-10 | Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all version… |
CVE-2022-0866 | Medium | 5.3 | 2022-05-10 | This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs pri… |
CVE-2022-1631 | High | 8.8 | 2022-05-09 | Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no… |
CVE-2022-29176 | Critical | 9.9 | 2022-05-05 | Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org u… |
CVE-2021-42192 | High | 8.8 | 2022-05-04 | Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. |
CVE-2021-36778 | High | 7.3 | 2022-05-02 | A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers… |
CVE-2022-0984 | Medium | 4.3 | 2022-04-29 | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, whic… |
CVE-2022-0985 | Medium | 4.3 | 2022-04-29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete c… |
CVE-2022-23822 | Medium | 6.8 | 2022-04-27 | In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicio… |
CVE-2022-1466 | Medium | 6.5 | 2022-04-26 | Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to… |
CVE-2020-14121 | Medium | 5.5 | 2022-04-21 | A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attac… |
CVE-2022-24865 | Medium | 6.5 | 2022-04-20 | HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other u… |
CVE-2022-27055 | High | 7.5 | 2022-04-19 | ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new en… |
CVE-2022-24841 | Medium | 6.5 | 2022-04-18 | fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization b… |
CVE-2020-25167 | Medium | 4.9 | 2022-04-18 | OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute. |
CVE-2022-1365 | Medium | 6.5 | 2022-04-15 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5. |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2021-39802 | High | 7.8 | 2022-04-12 | In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of… |
CVE-2021-39799 | High | 7.8 | 2022-04-12 | In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of… |
CVE-2021-0694 | High | 7.8 | 2022-04-12 | In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insuffi… |
CVE-2022-28542 | Medium | 6.8 | 2022-04-11 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2022-27836 | High | 8.4 | 2022-04-11 | Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers t… |
CVE-2022-27575 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without perm… |
CVE-2022-1193 | Medium | 4.3 | 2022-04-11 | Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain detail… |
CVE-2022-0920 | High | 7.5 | 2022-04-11 | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |
CVE-2022-27609 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with A… |
CVE-2022-27608 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. T… |
CVE-2022-0740 | Low | 3.1 | 2022-04-04 | Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all ve… |
CVE-2021-32986 | Critical | 9.8 | 2022-04-04 | After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout… |
CVE-2022-0825 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status… |
CVE-2022-1224 | Medium | 6.5 | 2022-04-04 | Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1223 | Medium | 6.5 | 2022-04-04 | Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-0406 | Medium | 4.3 | 2022-04-03 | Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2021-32960 | High | 8.5 | 2022-04-01 | Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a… |
CVE-2021-28504 | High | 7.5 | 2022-04-01 | On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that… |
CVE-2021-37517 | High | 7.5 | 2022-03-31 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email… |
CVE-2021-3456 | High | 7.1 | 2022-03-30 | An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limi… |
CVE-2021-39790 | High | 7.8 | 2022-03-30 | In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. This could lead to local escalation of privilege… |
CVE-2021-39789 | High | 7.8 | 2022-03-30 | In Telecom, there is a possible leak of TTY mode change due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2020-35501 | Low | 3.4 | 2022-03-30 | A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem |
CVE-2022-1177 | Medium | 4.3 | 2022-03-30 | Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. |
CVE-2020-24771 | High | 7.5 | 2022-03-30 | Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. |
CVE-2021-39876 | Medium | 4.3 | 2022-03-28 | In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. |
CVE-2022-0720 | Medium | 5.4 | 2022-03-28 | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as we… |
CVE-2022-24783 | Critical | 10.0 | 2022-03-25 | Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicio… |
CVE-2021-20290 | Medium | 6.1 | 2022-03-25 | An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be… |
CVE-2022-24778 | High | 7.5 | 2022-03-25 | The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by co… |
CVE-2022-26629 | Critical | 9.1 | 2022-03-24 | An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privil… |
CVE-2022-24730 | High | 7.7 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-0981 | High | 8.8 | 2022-03-23 | A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a… |
CVE-2021-24905 | High | 8.0 | 2022-03-21 | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and d… |
CVE-2022-24755 | High | 8.1 | 2022-03-15 | Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20… |
CVE-2022-24721 | High | 8.1 | 2022-03-15 | CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is impr… |
CVE-2022-24128 | High | 8.0 | 2022-03-13 | Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CRE… |
CVE-2022-0860 | Critical | 9.1 | 2022-03-11 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. |
CVE-2021-41233 | Medium | 6.5 | 2022-03-10 | Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is… |
CVE-2022-24609 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell fi… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |