CWE-863 · Incorrect Authorization (page 32)
Page 32 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4275 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cros… |
CVE-2022-23551 | Medium | 5.3 | 2022-12-21 | aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in A… |
CVE-2021-4268 | Medium | 4.3 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-si… |
CVE-2020-36623 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The ma… |
CVE-2020-36622 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site… |
CVE-2022-43872 | Medium | 5.3 | 2022-12-20 | IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical informati… |
CVE-2022-46076 | High | 7.5 | 2022-12-20 | D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi. |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2022-23490 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetin… |
CVE-2022-42351 | Medium | 4.3 | 2022-12-16 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A… |
CVE-2022-20558 | Low | 3.3 | 2022-12-16 | In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to loc… |
CVE-2022-41962 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status… |
CVE-2022-23741 | High | 7.2 | 2022-12-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner… |
CVE-2022-46160 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations… |
CVE-2022-23473 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not prope… |
CVE-2022-41274 | Medium | 6.5 | 2022-12-13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These… |
CVE-2022-3883 | Medium | 6.5 | 2022-12-12 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in… |
CVE-2022-3882 | Medium | 6.5 | 2022-12-12 | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in a… |
CVE-2022-3881 | Medium | 5.7 | 2022-12-12 | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not… |
CVE-2022-3880 | Medium | 6.5 | 2022-12-12 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation… |
CVE-2022-3879 | Medium | 6.5 | 2022-12-12 | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allo… |
CVE-2022-45956 | Medium | 5.3 | 2022-12-12 | Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic… |
CVE-2022-45760 | High | 8.8 | 2022-12-12 | SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. |
CVE-2022-4397 | Medium | 4.3 | 2022-12-10 | A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/C… |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2020-36610 | Medium | 4.3 | 2022-12-08 | A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2022-4349 | Medium | 4.3 | 2022-12-08 | A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cro… |
CVE-2022-46792 | High | 8.8 | 2022-12-08 | Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |
CVE-2022-44039 | Critical | 9.8 | 2022-12-05 | Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrit… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-46167 | High | 8.8 | 2022-12-02 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted wit… |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-24189 | Medium | 6.5 | 2022-11-28 | The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests t… |
CVE-2022-41944 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain con… |
CVE-2022-4090 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.ph… |
CVE-2022-41923 | Critical | 9.1 | 2022-11-23 | Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoi… |
CVE-2022-36785 | High | 7.5 | 2022-11-17 | D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15… |
CVE-2022-4014 | Medium | 4.3 | 2022-11-16 | A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My… |
CVE-2022-4013 | Medium | 4.3 | 2022-11-16 | A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appoi… |
CVE-2022-41918 | Medium | 6.3 | 2022-11-15 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules… |
CVE-2022-20928 | Medium | 5.8 | 2022-11-15 | A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defe… |
CVE-2022-45383 | Medium | 6.5 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downlo… |
CVE-2022-42978 | High | 7.5 | 2022-11-15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remot… |
CVE-2022-39385 | Medium | 6.5 | 2022-11-14 | Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-39388 | High | 7.6 | 2022-11-10 | Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload i… |
CVE-2022-3819 | Low | 3.5 | 2022-11-10 | An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malic… |
CVE-2022-41091 | Medium | 5.4 | 2022-11-09 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2022-39352 | Medium | 4.8 | 2022-11-08 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under… |
CVE-2022-20942 | Medium | 6.5 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Applian… |
CVE-2022-42788 | Medium | 5.5 | 2022-11-01 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may… |
CVE-2022-39322 | Critical | 9.1 | 2022-10-25 | @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who e… |
CVE-2022-42344 | High | 8.8 | 2022-10-20 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An aut… |
CVE-2022-3585 | Medium | 4.3 | 2022-10-18 | A vulnerability classified as problematic has been found in SourceCodester Simple Cold Storage Management System 1.0. Affected is an unknown function of the fi… |
CVE-2022-3582 | Medium | 4.3 | 2022-10-18 | A vulnerability has been found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2022-42975 | High | 7.5 | 2022-10-17 | socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence… |
CVE-2022-39302 | Medium | 5.5 | 2022-10-14 | Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel fr… |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-41574 | High | 7.5 | 2022-10-07 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with ar… |
CVE-2022-36634 | High | 8.8 | 2022-10-07 | An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-31252 | Medium | 4.4 | 2022-10-06 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did… |
CVE-2021-40692 | Medium | 4.3 | 2022-09-29 | Insufficient capability checks made it possible for teachers to download users outside of their courses. |
CVE-2022-39031 | Medium | 5.3 | 2022-09-28 | Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Sessi… |
CVE-2022-39030 | High | 7.5 | 2022-09-28 | smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to acces… |
CVE-2022-39029 | Medium | 6.5 | 2022-09-28 | Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to… |
CVE-2022-40816 | Medium | 6.5 | 2022-09-27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal… |
CVE-2022-3048 | Medium | 6.8 | 2022-09-26 | Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigat… |
CVE-2022-3024 | Medium | 5.4 | 2022-09-26 | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as… |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2022-0143 | Critical | 9.3 | 2022-09-19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to… |
CVE-2022-36074 | Medium | 6.4 | 2022-09-15 | Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Au… |
CVE-2022-36103 | High | 7.2 | 2022-09-13 | Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improp… |
CVE-2022-2990 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modificat… |
CVE-2022-2989 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modificati… |
CVE-2022-37767 | Critical | 9.8 | 2022-09-12 | Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this… |
CVE-2022-36109 | Medium | 5.3 | 2022-09-09 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are no… |
CVE-2022-23451 | High | 8.1 | 2022-09-06 | An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or d… |
CVE-2022-2597 | Medium | 5.4 | 2022-09-05 | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowin… |
CVE-2022-23452 | Medium | 4.9 | 2022-09-01 | An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an… |
CVE-2022-36051 | High | 8.7 | 2022-08-31 | ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a fe… |
CVE-2021-3563 | High | 7.4 | 2022-08-26 | A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity w… |
CVE-2021-3763 | Medium | 4.3 | 2022-08-23 | A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the ro… |
CVE-2022-35692 | Medium | 5.3 | 2022-08-19 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-36009 | Medium | 5.0 | 2022-08-19 | gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level par… |
CVE-2021-37409 | High | 7.8 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of pri… |
CVE-2022-1401 | Medium | 6.9 | 2022-08-17 | Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker… |
CVE-2022-34255 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2020-14321 | High | 8.8 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. |
CVE-2022-2354 | High | 7.2 | 2022-08-15 | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where… |
CVE-2022-35487 | High | 7.5 | 2022-08-08 | Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an… |
CVE-2022-33718 | Medium | 6.2 | 2022-08-05 | An improper access control vulnerability in Wi-Fi Service prior to SMR AUG-2022 Release 1 allows untrusted applications to manipulate the list of apps that can… |
CVE-2022-2501 | Medium | 5.9 | 2022-08-05 | An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attack… |
CVE-2022-2326 | Medium | 6.4 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2095 | Medium | 4.3 | 2022-08-05 | An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all ve… |