CWE-863 · Incorrect Authorization (page 29)
Page 29 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4107 | Medium | 6.7 | 2023-08-11 | Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details… |
CVE-2023-28714 | High | 8.2 | 2023-08-11 | Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user… |
CVE-2022-29871 | Medium | 6.7 | 2023-08-11 | Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2023-39965 | Medium | 6.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files throug… |
CVE-2023-30705 | Medium | 6.8 | 2023-08-10 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2023-33468 | Critical | 9.1 | 2023-08-09 | KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This… |
CVE-2023-24471 | Medium | 6.5 | 2023-08-09 | An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An a… |
CVE-2023-38209 | Medium | 6.5 | 2023-08-09 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that… |
CVE-2023-4242 | Medium | 4.3 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to impr… |
CVE-2023-37492 | Medium | 4.9 | 2023-08-08 | SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SA… |
CVE-2023-37491 | High | 7.5 | 2023-08-08 | The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53… |
CVE-2023-39363 | Medium | 5.9 | 2023-08-07 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated… |
CVE-2023-32783 | High | 7.5 | 2023-08-07 | The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a… |
CVE-2023-4194 | Medium | 5.5 | 2023-08-07 | A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to som… |
CVE-2023-20800 | Medium | 6.5 | 2023-08-07 | In imgsys, there is a possible system crash due to a mssing ptr check. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-28468 | Medium | 6.5 | 2023-08-03 | An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler t… |
CVE-2023-38958 | Medium | 5.3 | 2023-08-03 | An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotel… |
CVE-2023-23476 | Low | 3.1 | 2023-08-02 | IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some A… |
CVE-2023-36092 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerabili… |
CVE-2023-36091 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOT… |
CVE-2023-36090 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only… |
CVE-2023-36089 | Critical | 9.8 | 2023-07-31 | Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cg… |
CVE-2023-38488 | High | 7.1 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might hav… |
CVE-2023-3957 | Medium | 4.3 | 2023-07-27 | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_upda… |
CVE-2023-35983 | Medium | 5.5 | 2023-07-27 | This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be a… |
CVE-2023-39154 | Medium | 6.5 | 2023-07-26 | Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to con… |
CVE-2023-32629 | High | 7.8 | 2023-07-26 | Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu… |
CVE-2023-2640 | High | 7.8 | 2023-07-26 | On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may… |
CVE-2023-38503 | Medium | 5.7 | 2023-07-25 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters… |
CVE-2023-38493 | High | 7.5 | 2023-07-25 | Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or… |
CVE-2023-36826 | High | 7.7 | 2023-07-25 | Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a d… |
CVE-2023-38058 | Medium | 4.1 | 2023-07-24 | An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an tick… |
CVE-2023-36339 | High | 7.5 | 2023-07-21 | An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request. |
CVE-2023-3484 | High | 8.0 | 2023-07-21 | An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all version… |
CVE-2023-32482 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push p… |
CVE-2023-32261 | Medium | 4.2 | 2023-07-19 | A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permis… |
CVE-2023-34035 | High | 7.3 | 2023-07-18 | Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the appl… |
CVE-2022-26563 | High | 8.8 | 2023-07-18 | An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization. |
CVE-2023-3459 | High | 7.2 | 2023-07-18 | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_… |
CVE-2023-3613 | Low | 3.5 | 2023-07-17 | Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invite… |
CVE-2023-3590 | Low | 3.1 | 2023-07-17 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. |
CVE-2023-3586 | Medium | 4.2 | 2023-07-17 | Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boa… |
CVE-2023-3584 | Low | 3.1 | 2023-07-17 | Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated att… |
CVE-2023-3582 | Medium | 4.3 | 2023-07-17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private chann… |
CVE-2023-2759 | High | 8.8 | 2023-07-17 | A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users witho… |
CVE-2023-31704 | Critical | 9.8 | 2023-07-13 | Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the admin… |
CVE-2023-3444 | Medium | 5.7 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-2576 | Medium | 4.3 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-21256 | High | 7.8 | 2023-07-13 | In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to loca… |
CVE-2023-21254 | High | 7.8 | 2023-07-13 | In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the app is being killed due to a logic erro… |
CVE-2023-21245 | High | 7.8 | 2023-07-13 | In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a l… |
CVE-2023-37579 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0… |
CVE-2023-35908 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgra… |
CVE-2023-30429 | Critical | 9.6 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client… |
CVE-2023-30428 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to… |
CVE-2023-36994 | Critical | 9.8 | 2023-07-07 | In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code. |
CVE-2023-34197 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerabili… |
CVE-2023-36829 | Medium | 6.8 | 2023-07-06 | Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the… |
CVE-2023-29381 | Critical | 9.8 | 2023-07-06 | An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and… |
CVE-2022-48508 | High | 7.5 | 2023-07-06 | Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-29656 | Medium | 6.1 | 2023-07-06 | An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control "antigena"… |
CVE-2022-46080 | Critical | 9.8 | 2023-07-06 | Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET. |
CVE-2023-35939 | High | 8.1 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file access… |
CVE-2023-34107 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a o… |
CVE-2023-34106 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on… |
CVE-2021-46891 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2021-46890 | Critical | 9.8 | 2023-07-05 | Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confiden… |
CVE-2023-26258 | Critical | 9.8 | 2023-07-03 | Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. Thi… |
CVE-2023-31997 | Critical | 9.0 | 2023-07-01 | UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2023-37300 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hi… |
CVE-2023-33190 | Critical | 9.9 | 2023-06-29 | Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration… |
CVE-2023-30955 | Medium | 4.3 | 2023-06-29 | A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'… |
CVE-2023-21225 | High | 7.8 | 2023-06-28 | there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with… |
CVE-2023-22593 | Medium | 4.0 | 2023-06-27 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis contain… |
CVE-2021-30205 | Medium | 5.3 | 2023-06-27 | Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments a… |
CVE-2023-34148 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34147 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-34146 | High | 7.8 | 2023-06-26 | An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privi… |
CVE-2023-35165 | Medium | 6.6 | 2023-06-23 | AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudF… |
CVE-2023-32353 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges. |
CVE-2023-3114 | Medium | 5.0 | 2023-06-22 | Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agen… |
CVE-2023-34923 | High | 8.1 | 2023-06-22 | XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Pro… |
CVE-2023-29708 | High | 7.5 | 2023-06-22 | An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload. |
CVE-2023-0971 | Critical | 9.6 | 2023-06-21 | A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encry… |
CVE-2023-35166 | Critical | 9.9 | 2023-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the rig… |
CVE-2023-34161 | High | 7.5 | 2023-06-19 | nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2022-48495 | Medium | 5.3 | 2023-06-19 | Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obt… |
CVE-2022-48488 | Medium | 5.3 | 2023-06-19 | Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desk… |
CVE-2023-35866 | Medium | 5.5 | 2023-06-19 | In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, wi… |
CVE-2023-25185 | Low | 3.8 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software… |
CVE-2023-29296 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29295 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-29288 | Medium | 4.3 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-22248 | High | 7.5 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that co… |
CVE-2023-28175 | High | 7.1 | 2023-06-15 | Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal n… |
CVE-2022-22307 | Medium | 4.4 | 2023-06-15 | IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 2167… |
CVE-2022-31646 | High | 7.8 | 2023-06-14 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2022-31644 | High | 7.8 | 2023-06-14 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2023-32061 | Medium | 5.4 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |