CWE-863 · Incorrect Authorization (page 30)
Page 30 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2023-34965 | Medium | 5.3 | 2023-06-13 | SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information. |
CVE-2023-32220 | High | 8.2 | 2023-06-12 | Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. |
CVE-2023-32219 | Medium | 6.5 | 2023-06-12 | A Mazda model (2015-2016) can be unlocked via an unspecified method. |
CVE-2023-27716 | Critical | 9.8 | 2023-06-12 | An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it. |
CVE-2023-29766 | High | 7.8 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files. |
CVE-2023-29761 | Medium | 5.5 | 2023-06-09 | An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files. |
CVE-2023-29759 | Medium | 5.5 | 2023-06-09 | An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files. |
CVE-2023-29758 | Medium | 5.5 | 2023-06-09 | An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference f… |
CVE-2023-29752 | High | 7.8 | 2023-06-09 | An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component. |
CVE-2023-32749 | High | 8.8 | 2023-06-08 | Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such… |
CVE-2023-34958 | Medium | 4.3 | 2023-06-08 | Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if th… |
CVE-2021-4352 | Medium | 5.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in ver… |
CVE-2020-36710 | Medium | 5.3 | 2023-06-07 | The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it po… |
CVE-2023-33651 | High | 7.5 | 2023-06-06 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0… |
CVE-2023-32683 | Low | 3.5 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklis… |
CVE-2023-22833 | High | 7.6 | 2023-06-06 | Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organiz… |
CVE-2023-1779 | Medium | 4.3 | 2023-06-06 | Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtu… |
CVE-2023-21670 | High | 7.8 | 2023-06-06 | Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode. |
CVE-2022-40529 | High | 7.1 | 2023-06-06 | Memory corruption due to improper access control in kernel while processing a mapping request from root process. |
CVE-2023-3027 | High | 7.8 | 2023-06-05 | The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead… |
CVE-2023-3066 | High | 8.1 | 2023-06-05 | Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administrators… |
CVE-2023-25749 | Medium | 4.3 | 2023-06-02 | Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now con… |
CVE-2023-25729 | High | 8.8 | 2023-06-02 | Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user… |
CVE-2023-23604 | Medium | 6.5 | 2023-06-02 | A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to byp… |
CVE-2023-3033 | Medium | 6.8 | 2023-06-02 | Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2023-28698 | Critical | 9.8 | 2023-06-02 | Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying… |
CVE-2022-46308 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit thi… |
CVE-2022-46307 | High | 8.8 | 2023-06-02 | SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vul… |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |
CVE-2023-28352 | High | 7.4 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Stu… |
CVE-2023-24600 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book. |
CVE-2023-33779 | High | 8.8 | 2023-05-26 | A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request… |
CVE-2023-31226 | High | 7.5 | 2023-05-26 | The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-2002 | Medium | 6.8 | 2023-05-26 | A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows… |
CVE-2023-1158 | Medium | 4.3 | 2023-05-24 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of t… |
CVE-2023-31726 | High | 7.5 | 2023-05-23 | AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information. |
CVE-2023-23304 | Critical | 9.1 | 2023-05-23 | The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` m… |
CVE-2023-23299 | High | 7.5 | 2023-05-23 | The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious appli… |
CVE-2023-27920 | Medium | 4.3 | 2023-05-23 | Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versi… |
CVE-2023-27388 | Critical | 9.8 | 2023-05-23 | Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the prod… |
CVE-2023-27384 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data of MultiReport. |
CVE-2023-25946 | High | 8.8 | 2023-05-23 | Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communi… |
CVE-2023-33254 | Medium | 6.5 | 2023-05-21 | There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privile… |
CVE-2023-26818 | Medium | 5.5 | 2023-05-19 | Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. |
CVE-2023-31597 | Medium | 6.5 | 2023-05-18 | An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers ar… |
CVE-2023-2782 | Medium | 5.5 | 2023-05-18 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38. |
CVE-2023-29927 | Medium | 4.3 | 2023-05-16 | Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a w… |
CVE-2023-21117 | High | 7.8 | 2023-05-15 | In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permiss… |
CVE-2023-21116 | Medium | 6.7 | 2023-05-15 | In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in… |
CVE-2023-23446 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-23445 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-20880 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges… |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2023-29819 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload. |
CVE-2023-29818 | Medium | 5.5 | 2023-05-12 | An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via the default allow… |
CVE-2023-2515 | Medium | 4.7 | 2023-05-12 | Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin |
CVE-2023-28357 | Medium | 4.3 | 2023-05-11 | A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given… |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |
CVE-2022-45128 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2022-43465 | Medium | 5.0 | 2023-05-10 | Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2022-41610 | Medium | 5.0 | 2023-05-10 | Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to p… |
CVE-2023-24932 | Medium | 6.7 | 2023-05-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2023-32069 | Critical | 9.9 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute… |
CVE-2020-23362 | High | 7.1 | 2023-05-09 | Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter. |
CVE-2023-32060 | Medium | 6.5 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13… |
CVE-2023-31138 | High | 7.1 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1… |
CVE-2023-31141 | Medium | 4.8 | 2023-05-08 | OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the… |
CVE-2023-24505 | Medium | 5.3 | 2023-05-08 | Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. |
CVE-2023-27954 | Medium | 6.5 | 2023-05-08 | The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS… |
CVE-2023-27951 | Medium | 5.5 | 2023-05-08 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to… |
CVE-2023-23538 | Medium | 5.5 | 2023-05-08 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to modify protected part… |
CVE-2023-30840 | Medium | 5.8 | 2023-05-08 | Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior… |
CVE-2023-1979 | Medium | 4.9 | 2023-05-08 | The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible t… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2023-29240 | Medium | 5.4 | 2023-05-03 | An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software… |
CVE-2023-31435 | High | 8.1 | 2023-05-02 | Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 228… |
CVE-2022-47874 | Medium | 6.5 | 2023-05-02 | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox… |
CVE-2023-30024 | Medium | 6.6 | 2023-04-28 | The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attacker… |
CVE-2023-30467 | High | 7.5 | 2023-04-28 | This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper au… |
CVE-2022-25091 | Medium | 5.3 | 2023-04-27 | Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the… |
CVE-2022-37326 | High | 7.8 | 2023-04-27 | Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling… |
CVE-2023-26246 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26245 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during… |
CVE-2023-26244 | High | 7.8 | 2023-04-27 | An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used durin… |
CVE-2023-27107 | High | 8.8 | 2023-04-26 | Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do… |
CVE-2023-31250 | Medium | 6.5 | 2023-04-26 | The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they s… |
CVE-2022-25274 | Medium | 5.4 | 2023-04-26 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting i… |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2023-20871 | High | 7.8 | 2023-04-25 | VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges… |
CVE-2021-44465 | Medium | 4.3 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future n… |
CVE-2021-23203 | High | 7.5 | 2023-04-25 | Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF… |
CVE-2023-2257 | High | 7.8 | 2023-04-24 | Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access t… |
CVE-2023-26097 | High | 8.4 | 2023-04-24 | An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked. |
CVE-2023-30544 | Low | 3.9 | 2023-04-24 | Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile… |
CVE-2023-20950 | High | 7.8 | 2023-04-19 | In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch restrictions via a pendingIntent. This could… |
CVE-2023-25548 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured whe… |
CVE-2023-25547 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low pri… |
CVE-2023-2020 | Medium | 4.3 | 2023-04-18 | Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. |