CWE-285: Improper Authorization, page 25

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

1. 8.1CVE-2023-50363EPSS 0.4%2024-04-26

   An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have alr…

2. 6.5CVE-2023-5675EPSS 0.5%2024-04-25

   A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these met…

3. 7.5CVE-2024-3840EPSS 0.9%2024-04-17

   Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

4. 6.1CVE-2024-21039EPSS 0.3%2024-04-16

   Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

5. 6.1CVE-2024-21035EPSS 0.4%2024-04-16

   Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

6. 6.1CVE-2024-21031EPSS 0.3%2024-04-16

   Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

7. 7.1CVE-2024-21026EPSS 0.4%2024-04-16

   Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

8. 6.1CVE-2024-21018EPSS 0.3%2024-04-16

   Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated at…

9. 6.4CVE-2024-3027EPSS 0.3%2024-04-13

   The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated at…

10. 5.4CVE-2024-1289EPSS 0.4%2024-04-09

    The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information…

11. 6.4CVE-2024-26193EPSS 0.9%2024-04-09

    Azure Migrate Remote Code Execution Vulnerability

12. 7.5CVE-2023-52539EPSS 0.3%2024-04-08

    Permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

13. 7.5CVE-2023-52359EPSS 0.4%2024-04-08

    Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vulnerability will affect availability.

14. 5.4CVE-2024-3434EPSS 0.5%2024-04-08

    A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the component User Management. The manipulation leads to improper authorization. The att…

15. 4.3CVE-2024-30260EPSS 0.7%2024-04-04

    Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 …

16. 5.4CVE-2024-3139EPSS 0.5%2024-04-01

    A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the…

17. 2.1CVE-2024-3013EPSS 23%2024-03-28

    A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authori…

18. 7.8CVE-2024-0077EPSS 0.2%2024-03-27

    NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate resources for which the guest OS is not authorized. A successful exploit of this vulnerability may lead to code execution, denia…

19. 4.3CVE-2024-20333EPSS 0.4%2024-03-27

    A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to change specific data within the interface on an affected device. This vulnerabil…

20. 4.3CVE-2024-27916EPSS 0.7%2024-03-21

    Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespecti…

21. 9.1CVE-2024-29033EPSS 0.6%2024-03-20

    OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google ac…

22. 5.3CVE-2024-2641EPSS 0.8%2024-03-19

    A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passwdManage.htm of the component Password Handler. The manipulation leads to imprope…

23. 4.3CVE-2024-27937EPSS 27%2024-03-18

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched …

24. 6.5CVE-2024-27930EPSS 1.1%2024-03-18

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. Thi…

25. 9.1CVE-2024-2557EPSS 1.0%2024-03-17

    A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin.php. The manipulation leads to improper authorization. The attack c…

26. 4.3CVE-2024-21761EPSS 0.4%2024-03-12

    An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload.

27. 9.1CVE-2024-2317EPSS 0.8%2024-03-08

    A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipu…

28. 7.5CVE-2024-25063EPSS 0.6%2024-03-02

    Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker should not have access to.

29. 7.3CVE-2024-24900EPSS 0.2%2024-03-01

    Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices adde…

30. 6.5CVE-2024-1043EPSS 0.7%2024-02-29

    The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. Th…

31. 5.4CVE-2024-20943EPSS 0.3%2024-02-17

    Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker…

32. 5.4CVE-2024-21987EPSS 0.3%2024-02-16

    SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings

33. 6.7CVE-2023-38135EPSS 0.2%2024-02-14

    Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local access.

34. 7.1CVE-2024-21402EPSS 0.5%2024-02-13

    Microsoft Outlook Elevation of Privilege Vulnerability

35. 8.8CVE-2024-25108EPSS 0.7%2024-02-12

    Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative a…

36. 6.5CVE-2024-25106EPSS 0.5%2024-02-08

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulner…

37. 8.8CVE-2024-24830EPSS 0.7%2024-02-08

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any a…

38. 5.3CVE-2024-23806EPSS 0.3%2024-02-07

    Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

39. 4.3CVE-2024-22021EPSS 0.4%2024-02-07

    Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.

40. 5.3CVE-2024-24936EPSS 0.3%2024-02-06

    In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed

41. 6.5CVE-2023-32967EPSS 0.3%2024-02-02

    An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuT…

42. 6.5CVE-2024-23649EPSS 0.5%2024-01-24

    Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating …

43. 8.8CVE-2023-40683EPSS 0.7%2024-01-19

    IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit thi…

44. 5.4CVE-2024-20979EPSS 0.3%2024-01-16

    Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker w…

45. 4.3CVE-2022-4962EPSS 0.5%2024-01-12

    A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization.…

46. 6.5CVE-2023-6878EPSS 0.5%2024-01-11

    The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_update' function in versions up to, and including, 2.4.11. This makes it possible f…

47. 5.3CVE-2023-6496EPSS 0.5%2024-01-11

    The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to ob…

48. 5.5CVE-2023-40430EPSS 0.2%2024-01-10

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent.

49. 8.8CVE-2023-48252EPSS 0.6%2024-01-10

    The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.

50. 9.6CVE-2023-52139EPSS 0.5%2023-12-29

    Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe7…