CWE-863 · Incorrect Authorization (page 33)
Page 33 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2022-35924 | Critical | 9.1 | 2022-08-02 | NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions… |
CVE-2022-35921 | Low | 3.5 | 2022-08-01 | fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of By… |
CVE-2022-31190 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affec… |
CVE-2022-31178 | Medium | 4.3 | 2022-08-01 | eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a template without being… |
CVE-2022-31155 | Medium | 4.3 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ sa… |
CVE-2022-31154 | Medium | 6.4 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any oth… |
CVE-2022-35716 | Medium | 6.5 | 2022-08-01 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticate… |
CVE-2022-22326 | Low | 3.3 | 2022-08-01 | IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and fil… |
CVE-2022-1499 | Medium | 6.3 | 2022-07-26 | Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2022-1309 | Critical | 9.6 | 2022-07-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2022-0670 | Critical | 9.1 | 2022-07-25 | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vul… |
CVE-2022-0594 | Medium | 5.3 | 2022-07-25 | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action… |
CVE-2022-1132 | Medium | 6.1 | 2022-07-23 | Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restriction… |
CVE-2022-31168 | Medium | 5.4 | 2022-07-22 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API… |
CVE-2022-34046 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtm… |
CVE-2022-26479 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor) causes all API ca… |
CVE-2022-36126 | High | 7.2 | 2022-07-16 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbi… |
CVE-2022-35890 | Critical | 9.8 | 2022-07-15 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacke… |
CVE-2022-31153 | Medium | 6.5 | 2022-07-15 | OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to… |
CVE-2022-31107 | High | 7.1 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious use… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-30203 | High | 7.4 | 2022-07-12 | Windows Boot Manager Security Feature Bypass Vulnerability |
CVE-2022-29619 | Medium | 6.5 | 2022-07-12 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of… |
CVE-2022-31139 | Medium | 5.9 | 2022-07-11 | UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is p… |
CVE-2022-32294 | Critical | 9.8 | 2022-07-11 | Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartex… |
CVE-2022-32290 | Medium | 4.3 | 2022-07-06 | The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP prox… |
CVE-2022-32310 | Critical | 9.8 | 2022-07-05 | An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/User… |
CVE-2022-1981 | Low | 2.7 | 2022-07-01 | An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab… |
CVE-2022-1983 | Medium | 6.5 | 2022-07-01 | Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker alr… |
CVE-2022-34814 | Medium | 4.3 | 2022-06-30 | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re… |
CVE-2022-34785 | Medium | 4.3 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-34782 | Medium | 4.3 | 2022-06-30 | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending re… |
CVE-2022-29271 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an a… |
CVE-2022-32532 | Critical | 9.8 | 2022-06-29 | Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `… |
CVE-2022-31087 | High | 7.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31039 | Medium | 4.3 | 2022-06-27 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are no… |
CVE-2022-1746 | High | 7.6 | 2022-06-24 | The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic… |
CVE-2022-34180 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unpro… |
CVE-2022-22967 | High | 8.8 | 2022-06-23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously author… |
CVE-2017-20066 | Medium | 5.3 | 2022-06-20 | A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to imprope… |
CVE-2022-26668 | High | 7.3 | 2022-06-20 | ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial syst… |
CVE-2022-31589 | Medium | 6.5 | 2022-06-14 | Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authori… |
CVE-2022-27668 | Critical | 9.8 | 2022-06-14 | Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administ… |
CVE-2021-35112 | High | 8.4 | 2022-06-14 | A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdragon Auto, Snapdragon… |
CVE-2022-33174 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the… |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2022-1944 | Medium | 5.4 | 2022-06-06 | When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10… |
CVE-2022-1936 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1935 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1589 | High | 7.5 | 2022-05-30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, wh… |
CVE-2022-26767 | Medium | 5.5 | 2022-05-26 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be ab… |
CVE-2022-30016 | High | 8.8 | 2022-05-23 | Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info. |
CVE-2022-22978 | Critical | 9.8 | 2022-05-19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on… |
CVE-2021-3956 | Medium | 4.3 | 2022-05-18 | A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devic… |
CVE-2022-1706 | Medium | 6.5 | 2022-05-17 | A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only… |
CVE-2022-1753 | Medium | 5.4 | 2022-05-17 | A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The… |
CVE-2022-1553 | Medium | 4.9 | 2022-05-16 | Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vul… |
CVE-2022-0574 | Medium | 6.5 | 2022-05-16 | Improper Access Control in GitHub repository publify/publify prior to 9.2.8. |
CVE-2022-29854 | Medium | 6.8 | 2022-05-13 | A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physica… |
CVE-2022-29218 | High | 7.7 | 2022-05-13 | RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some g… |
CVE-2022-27134 | High | 7.5 | 2022-05-13 | EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryp… |
CVE-2022-23139 | High | 8.8 | 2022-05-12 | ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the ac… |
CVE-2022-24584 | Medium | 6.5 | 2022-05-11 | Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly crea… |
CVE-2022-28774 | Medium | 5.5 | 2022-05-11 | Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. |
CVE-2022-1460 | Medium | 6.1 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions star… |
CVE-2022-1124 | Medium | 4.3 | 2022-05-11 | An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10… |
CVE-2022-28601 | Medium | 6.5 | 2022-05-10 | A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number us… |
CVE-2022-1417 | Medium | 4.3 | 2022-05-10 | Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all version… |
CVE-2022-0866 | Medium | 5.3 | 2022-05-10 | This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs pri… |
CVE-2022-1631 | High | 8.8 | 2022-05-09 | Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no… |
CVE-2022-29176 | Critical | 9.9 | 2022-05-05 | Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org u… |
CVE-2021-42192 | High | 8.8 | 2022-05-04 | Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. |
CVE-2021-36778 | High | 7.3 | 2022-05-02 | A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers… |
CVE-2022-0984 | Medium | 4.3 | 2022-04-29 | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, whic… |
CVE-2022-0985 | Medium | 4.3 | 2022-04-29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete c… |
CVE-2022-23822 | Medium | 6.8 | 2022-04-27 | In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicio… |
CVE-2022-1466 | Medium | 6.5 | 2022-04-26 | Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to… |
CVE-2020-14121 | Medium | 5.5 | 2022-04-21 | A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attac… |
CVE-2022-24865 | Medium | 6.5 | 2022-04-20 | HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other u… |
CVE-2022-27055 | High | 7.5 | 2022-04-19 | ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new en… |
CVE-2022-24841 | Medium | 6.5 | 2022-04-18 | fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization b… |
CVE-2020-25167 | Medium | 4.9 | 2022-04-18 | OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute. |
CVE-2022-1365 | Medium | 6.5 | 2022-04-15 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5. |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2021-39802 | High | 7.8 | 2022-04-12 | In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of… |
CVE-2021-39799 | High | 7.8 | 2022-04-12 | In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of… |
CVE-2021-0694 | High | 7.8 | 2022-04-12 | In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insuffi… |
CVE-2022-28542 | Medium | 6.8 | 2022-04-11 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2022-27836 | High | 8.4 | 2022-04-11 | Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers t… |
CVE-2022-27575 | Low | 3.3 | 2022-04-11 | Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without perm… |
CVE-2022-1193 | Medium | 4.3 | 2022-04-11 | Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain detail… |
CVE-2022-0920 | High | 7.5 | 2022-04-11 | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |
CVE-2022-27609 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with A… |
CVE-2022-27608 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. T… |