CWE-863 · Incorrect Authorization (page 28)
Page 28 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5995 | Medium | 4.4 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-4658 | Low | 3.1 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-4317 | Medium | 4.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions star… |
CVE-2023-3964 | Medium | 4.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-3443 | Low | 3.1 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-47827 | Medium | 6.5 | 2023-11-30 | Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2023-40610 | Medium | 6.3 | 2023-11-27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection tha… |
CVE-2023-48712 | High | 7.1 | 2023-11-24 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin… |
CVE-2023-5553 | High | 7.6 | 2023-11-21 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot… |
CVE-2023-5799 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete p… |
CVE-2023-5509 | Medium | 5.4 | 2023-11-20 | The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions. |
CVE-2023-48309 | Medium | 5.3 | 2023-11-20 | NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affecte… |
CVE-2023-48218 | Medium | 5.3 | 2023-11-20 | The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field… |
CVE-2023-3379 | Medium | 5.3 | 2023-11-20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin use… |
CVE-2023-45626 | Medium | 5.5 | 2023-11-14 | An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across b… |
CVE-2022-40681 | High | 7.1 | 2023-11-14 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to cause denial o… |
CVE-2023-43901 | High | 7.5 | 2023-11-14 | Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privil… |
CVE-2023-31403 | Critical | 9.6 | 2023-11-14 | SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious… |
CVE-2023-47037 | Medium | 4.3 | 2023-11-12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerabi… |
CVE-2023-4379 | High | 8.1 | 2023-11-09 | An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner… |
CVE-2023-46244 | Critical | 9.1 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write… |
CVE-2023-42553 | Medium | 4.0 | 2023-11-07 | Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email. |
CVE-2023-42541 | Medium | 4.0 | 2023-11-07 | Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. |
CVE-2023-5352 | Medium | 4.3 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not… |
CVE-2023-20048 | Critical | 9.9 | 2023-11-01 | A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute cert… |
CVE-2023-46992 | High | 7.5 | 2023-10-31 | TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authenticati… |
CVE-2023-22518 | Critical | 9.8 | 2023-10-31 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthent… |
CVE-2023-45899 | High | 7.5 | 2023-10-31 | An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a craf… |
CVE-2023-46139 | Medium | 5.0 | 2023-10-31 | KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a m… |
CVE-2023-21390 | High | 7.8 | 2023-10-30 | In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no ad… |
CVE-2023-47090 | Medium | 6.5 | 2023-10-30 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for u… |
CVE-2023-21311 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information di… |
CVE-2023-40117 | High | 7.8 | 2023-10-27 | In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of priv… |
CVE-2023-46754 | Medium | 5.3 | 2023-10-26 | The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. |
CVE-2023-46753 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an… |
CVE-2023-41077 | Medium | 5.5 | 2023-10-25 | An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks. |
CVE-2023-46125 | Medium | 6.5 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-43961 | High | 8.8 | 2023-10-25 | An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2023-43508 | Medium | 6.3 | 2023-10-25 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change th… |
CVE-2021-4334 | High | 8.8 | 2023-10-20 | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_… |
CVE-2020-36714 | High | 7.4 | 2023-10-20 | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to… |
CVE-2023-34051 | Critical | 9.8 | 2023-10-20 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system… |
CVE-2023-22067 | Medium | 5.3 | 2023-10-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are… |
CVE-2023-43119 | Critical | 9.8 | 2023-10-16 | An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated priv… |
CVE-2023-29484 | Medium | 6.5 | 2023-10-16 | In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password. |
CVE-2023-38218 | High | 8.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Autho… |
CVE-2023-40829 | High | 7.5 | 2023-10-12 | There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000. |
CVE-2023-41882 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collabo… |
CVE-2023-35653 | Medium | 4.4 | 2023-10-11 | In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-28635 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allow… |
CVE-2023-5521 | Critical | 9.8 | 2023-10-11 | Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9. |
CVE-2023-36556 | High | 8.8 | 2023-10-10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an auth… |
CVE-2023-44860 | High | 7.5 | 2023-10-06 | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request. |
CVE-2022-3248 | Medium | 4.4 | 2023-10-05 | A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries… |
CVE-2023-1832 | Medium | 6.8 | 2023-10-04 | An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confident… |
CVE-2023-4997 | High | 8.8 | 2023-10-04 | Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users includ… |
CVE-2023-5106 | High | 8.2 | 2023-10-02 | An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to… |
CVE-2023-5195 | Medium | 6.5 | 2023-09-29 | Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of |
CVE-2023-5194 | Low | 2.7 | 2023-09-29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manag… |
CVE-2023-5193 | Medium | 4.9 | 2023-09-29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a… |
CVE-2023-5159 | Low | 3.8 | 2023-09-29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots… |
CVE-2023-5198 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16… |
CVE-2023-4532 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3979 | Low | 3.1 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3920 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-41078 | Medium | 5.5 | 2023-09-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy prefe… |
CVE-2023-35990 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be… |
CVE-2023-4853 | High | 8.1 | 2023-09-20 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in inco… |
CVE-2022-47553 | High | 8.6 | 2023-09-19 | Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, withou… |
CVE-2023-5009 | High | 8.2 | 2023-09-19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possi… |
CVE-2023-4814 | High | 7.1 | 2023-09-14 | A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does… |
CVE-2023-20191 | Medium | 5.8 | 2023-09-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2023-20190 | Medium | 5.8 | 2023-09-13 | A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |
CVE-2023-37881 | Medium | 4.9 | 2023-09-12 | Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2023-30995 | High | 7.5 | 2023-09-08 | IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP requ… |
CVE-2023-37367 | Medium | 5.3 | 2023-09-08 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exy… |
CVE-2023-38486 | High | 7.7 | 2023-09-06 | A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security control… |
CVE-2023-20269 | Medium | 5.0 | 2023-09-06 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-32672 | Medium | 4.3 | 2023-09-06 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tabl… |
CVE-2023-36387 | Medium | 5.4 | 2023-09-06 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database co… |
CVE-2023-27526 | Medium | 4.3 | 2023-09-06 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. |
CVE-2023-27523 | Medium | 5.0 | 2023-09-06 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on… |
CVE-2017-9453 | Critical | 9.0 | 2023-09-05 | BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. |
CVE-2023-4269 | Medium | 4.3 | 2023-09-04 | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subs… |
CVE-2023-3814 | Medium | 4.9 | 2023-09-04 | The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list a… |
CVE-2023-0120 | Low | 3.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-3253 | Medium | 4.3 | 2023-08-29 | An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the app… |
CVE-2023-34724 | Medium | 6.8 | 2023-08-28 | An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART interface. |
CVE-2023-4227 | Medium | 5.3 | 2023-08-24 | A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to… |
CVE-2023-3899 | High | 7.8 | 2023-08-23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1… |
CVE-2022-48538 | Medium | 5.3 | 2023-08-22 | In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a ze… |
CVE-2023-38035 | Critical | 9.8 | 2023-08-21 | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication contr… |
CVE-2023-40315 | Medium | 5.3 | 2023-08-17 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate thei… |
CVE-2023-40168 | High | 7.4 | 2023-08-17 | TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project… |
CVE-2023-25647 | Medium | 4.7 | 2023-08-17 | There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor… |
CVE-2023-33237 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication… |
CVE-2023-32748 | Critical | 9.8 | 2023-08-14 | The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to… |
CVE-2023-39384 | High | 7.5 | 2023-08-13 | Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abn… |