CWE-863 · Incorrect Authorization (page 31)
Page 31 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2020-17354 | High | 8.6 | 2023-04-15 | LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme… |
CVE-2023-22620 | High | 7.5 | 2023-04-12 | An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authen… |
CVE-2023-28270 | Medium | 6.8 | 2023-04-11 | Windows Lock Screen Security Feature Bypass Vulnerability |
CVE-2023-28249 | Medium | 6.2 | 2023-04-11 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-25415 | Medium | 5.3 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Event Notification configuration. |
CVE-2022-40682 | High | 7.8 | 2023-04-11 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauth… |
CVE-2022-43770 | Medium | 5.4 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashb… |
CVE-2023-1417 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possibl… |
CVE-2023-1071 | Low | 3.1 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fro… |
CVE-2023-0319 | Medium | 5.8 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions sta… |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2022-43940 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the… |
CVE-2023-1603 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted righ… |
CVE-2023-1202 | Medium | 6.5 | 2023-04-02 | Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with r… |
CVE-2023-23594 | Critical | 9.8 | 2023-03-31 | An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated… |
CVE-2023-26829 | Critical | 9.8 | 2023-03-31 | An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password f… |
CVE-2022-27642 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentic… |
CVE-2023-22251 | Medium | 4.3 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authentica… |
CVE-2023-1144 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Ga… |
CVE-2023-1136 | Critical | 9.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentica… |
CVE-2023-25017 | High | 8.1 | 2023-03-27 | RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific p… |
CVE-2023-21035 | High | 7.8 | 2023-03-24 | In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name… |
CVE-2023-21034 | High | 7.8 | 2023-03-24 | In multiple functions of SensorService.cpp, there is a possible access of accurate sensor data due to a permissions bypass. This could lead to local escalation… |
CVE-2023-20975 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_CONTENT_CAPTURE due to a permissions bypa… |
CVE-2023-20971 | High | 7.8 | 2023-03-24 | In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in… |
CVE-2023-28611 | Critical | 9.8 | 2023-03-23 | Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions. |
CVE-2023-23192 | High | 7.2 | 2023-03-23 | IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task. |
CVE-2023-25924 | Medium | 5.4 | 2023-03-22 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have acce… |
CVE-2023-25594 | Medium | 6.3 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change… |
CVE-2023-25923 | Low | 2.7 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service a… |
CVE-2023-27578 | Critical | 9.1 | 2023-03-20 | Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insuffici… |
CVE-2023-0940 | High | 8.8 | 2023-03-20 | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows… |
CVE-2023-27594 | Medium | 4.2 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific condit… |
CVE-2023-26484 | High | 8.2 | 2023-03-15 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-h… |
CVE-2023-24880 | Medium | 4.4 | 2023-03-14 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2022-39214 | Critical | 9.6 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take ov… |
CVE-2023-24999 | Medium | 4.4 | 2023-03-11 | HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID o… |
CVE-2023-27903 | Medium | 4.4 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27899 | High | 7.0 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2022-4315 | Medium | 5.0 | 2023-03-08 | An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every requ… |
CVE-2023-22891 | High | 8.1 | 2023-03-08 | There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords… |
CVE-2023-27486 | High | 8.1 | 2023-03-08 | xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters… |
CVE-2023-27485 | Medium | 4.3 | 2023-03-07 | thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` f… |
CVE-2023-0328 | Medium | 4.3 | 2023-03-06 | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to a… |
CVE-2023-1164 | High | 8.4 | 2023-03-03 | A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the comp… |
CVE-2023-26056 | Medium | 5.4 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the… |
CVE-2023-0952 | Medium | 6.5 | 2023-03-01 | Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper aut… |
CVE-2023-25575 | High | 7.7 | 2023-02-28 | API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatf… |
CVE-2023-23510 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a user’s Safari history. |
CVE-2023-23506 | Medium | 5.5 | 2023-02-27 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access user-sensitive data. |
CVE-2022-46704 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may… |
CVE-2023-23918 | High | 7.5 | 2023-02-23 | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (h… |
CVE-2023-23064 | Critical | 9.8 | 2023-02-17 | TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control. |
CVE-2021-32163 | Critical | 9.8 | 2023-02-17 | Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. |
CVE-2023-24485 | High | 7.8 | 2023-02-16 | Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace… |
CVE-2023-23947 | Critical | 9.1 | 2023-02-16 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and… |
CVE-2023-25173 | Medium | 5.3 | 2023-02-16 | containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up pro… |
CVE-2023-21715 | High | 7.3 | 2023-02-14 | Microsoft Publisher Security Feature Bypass Vulnerability |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2022-34397 | Medium | 6.9 | 2023-02-13 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, all… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-21424 | Medium | 5.1 | 2023-02-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify netwo… |
CVE-2023-21423 | Medium | 5.1 | 2023-02-09 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unp… |
CVE-2023-21422 | Medium | 5.7 | 2023-02-09 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without per… |
CVE-2022-45544 | High | 8.8 | 2023-02-07 | Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao par… |
CVE-2023-23696 | High | 7.0 | 2023-02-07 | Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could p… |
CVE-2023-24029 | High | 7.2 | 2023-02-03 | In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient… |
CVE-2023-23751 | Medium | 4.3 | 2023-02-01 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs. |
CVE-2022-47002 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request. |
CVE-2023-23924 | Critical | 10.0 | 2023-02-01 | Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This ma… |
CVE-2022-45172 | Critical | 9.8 | 2023-01-31 | An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the… |
CVE-2023-22610 | Critical | 9.1 | 2023-01-31 | A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the… |
CVE-2022-45435 | Medium | 6.8 | 2023-01-31 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2023-22500 | High | 7.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerabili… |
CVE-2023-22482 | Critical | 9.0 | 2023-01-26 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6… |
CVE-2023-21719 | Medium | 6.5 | 2023-01-24 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2022-23739 | Critical | 9.8 | 2023-01-17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub… |
CVE-2022-45353 | Medium | 4.3 | 2023-01-14 | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. |
CVE-2023-0298 | Medium | 6.5 | 2023-01-14 | Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-0091 | Low | 3.8 | 2023-01-13 | A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker… |
CVE-2022-2155 | Medium | 5.7 | 2023-01-12 | A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limi… |
CVE-2022-4167 | Medium | 5.3 | 2023-01-12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group acces… |
CVE-2023-22945 | Medium | 4.3 | 2023-01-11 | In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll a… |
CVE-2023-21560 | Medium | 6.6 | 2023-01-10 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2023-0133 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permis… |
CVE-2015-10033 | Low | 3.5 | 2023-01-09 | A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipu… |
CVE-2022-46258 | Medium | 6.5 | 2023-01-09 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Act… |
CVE-2022-43438 | High | 8.8 | 2023-01-03 | The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnera… |
CVE-2022-23553 | High | 7.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are… |
CVE-2021-45466 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_ke… |
CVE-2022-45891 | Critical | 9.1 | 2022-12-25 | Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access content uploaded b… |
CVE-2022-38475 | Medium | 6.5 | 2022-12-22 | An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to… |
CVE-2022-22754 | Medium | 6.5 | 2022-12-22 | If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new… |
CVE-2020-36625 | Medium | 4.3 | 2022-12-22 | A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The man… |
CVE-2022-3188 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication an… |