CWE-285: Improper Authorization, page 28

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

1. 7.8CVE-2023-26466EPSS 0.2%2023-04-10

   A user with non-Admin access can change a configuration file on the client to modify the Server URL.

2. 5.3CVE-2023-1167EPSS 0.6%2023-04-05

   Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.

3. 8.8CVE-2023-28634EPSS 0.8%2023-04-05

   GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it…

4. 6.5CVE-2023-0665EPSS 0.3%2023-03-30

   HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key mater…

5. 7.8CVE-2022-3787EPSS 0.2%2023-03-29

   A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain socket…

6. 7.2CVE-2022-3685EPSS 0.3%2023-03-28

   A vulnerability exists in the SDM600 software. The software operates at a privilege level that is higher than the minimum level required. An attacker who successfully exploits this vulnerability can escalate privileges. This issue affec…

7. 9.1CVE-2022-3686EPSS 1.4%2023-03-28

   A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive. This issue affects: All SDM600 ver…

8. 7.5CVE-2022-3683EPSS 0.5%2023-03-28

   A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could read data directly from a data store that is not restricted, or insufficiently pr…

9. 4.3CVE-2022-40208EPSS 0.6%2023-03-24

   In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.

10. 7.3CVE-2023-27594EPSS 0.6%2023-03-17

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, ide…

11. 5.5CVE-2023-21461EPSS 0.1%2023-03-16

    Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via unprotected activity.

12. 2.4CVE-2023-21454EPSS 0.2%2023-03-16

    Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen.

13. 3.3CVE-2023-21452EPSS 0.1%2023-03-16

    Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device.

14. 4.6CVE-2022-46752EPSS 0.3%2023-03-08

    Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.

15. 5.3CVE-2023-0734EPSS 0.5%2023-03-05

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

16. 7.5CVE-2023-20088EPSS 0.8%2023-03-03

    A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users …

17. 7.8CVE-2023-1164EPSS 0.4%2023-03-03

    A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack …

18. 3.3CVE-2023-22636EPSS 0.2%2023-02-27

    An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request.

19. 5.3CVE-2023-0914EPSS 0.6%2023-02-19

    Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

20. 8.8CVE-2023-0822EPSS 0.6%2023-02-17

    The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.

21. 9.8CVE-2022-38375EPSS 1.1%2023-02-16

    An improper authorization vulnerability [CWE-285]  in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST …

22. 4.3CVE-2023-22938EPSS 0.4%2023-02-14

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the lo…

23. 4.3CVE-2023-22931EPSS 0.4%2023-02-14

    In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and dis…

24. 8.1CVE-2022-34446EPSS 0.8%2023-02-11

    PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability. An authenticated remote user with limited privileges (e.g., of role Monitoring) can exploit this issue and gain access to sensitive inform…

25. 5.5CVE-2023-21440EPSS 0.2%2023-02-09

    Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.

26. 3.3CVE-2023-21436EPSS 0.1%2023-02-09

    Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.

27. 7.8CVE-2023-21433EPSS 3.7%2023-02-09

    Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store.

28. 7.8CVE-2023-21432EPSS 0.2%2023-02-09

    Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner.

29. 3.3CVE-2023-21429EPSS 0.2%2023-02-09

    Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.

30. 3.3CVE-2023-21424EPSS 0.2%2023-02-09

    Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values, network code, carrier id and operator brand.

31. 5.5CVE-2023-21423EPSS 0.1%2023-02-09

    Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.

32. 5.5CVE-2023-21422EPSS 0.1%2023-02-09

    Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding WifiService.

33. 7.8CVE-2023-23696EPSS 0.5%2023-02-07

    Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. A locally authenticated malicious users could potentially exploit this vulnerability in order to write arbitrary files to the sy…

34. 9.8CVE-2022-3229ExploitEPSS 66%2023-02-06

    Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol,…

35. 8.8CVE-2022-24894EPSS 4.0%2023-02-03

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a …

36. 4.3CVE-2023-0610EPSS 0.4%2023-02-01

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

37. 4.3CVE-2023-0609EPSS 0.6%2023-02-01

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

38. 7.8CVE-2022-4062EPSS 0.2%2023-02-01

    A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Product…

39. 4.9CVE-2022-3740EPSS 1.1%2023-01-26

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to …

40. 7.3CVE-2022-34405EPSS 0.2%2023-01-26

    An improper access control vulnerability was identified in the Realtek audio driver. A local authenticated malicious user may potentially exploit this vulnerability by waiting for an administrator to launch the application and attach to th…

41. 9.8CVE-2023-22480ExploitEPSS 67%2023-01-14

    KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak…

42. 8.8CVE-2023-21549EPSS 1.5%2023-01-10

    Windows SMB Witness Service Elevation of Privilege Vulnerability

43. 8.8CVE-2022-4701EPSS 0.8%2023-01-10

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those w…

44. 6.5CVE-2015-10033EPSS 0.8%2023-01-09

    A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipulation leads to improper authorization. The identifier of the patch is 134f5481e…

45. 7.5CVE-2022-4879EPSS 0.5%2023-01-06

    A vulnerability was found in Forged Alliance Forever up to 3746. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Vote Handler. The manipulation leads to improper authorization. …

46. 4.3CVE-2022-4868EPSS 0.7%2022-12-31

    Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

47. 5.5CVE-2022-45874EPSS 0.1%2022-12-28

    Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file.

48. 5.3CVE-2022-4804EPSS 0.6%2022-12-28

    Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.

49. 8.8CVE-2022-4688EPSS 0.8%2022-12-23

    Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.

50. 6.5CVE-2022-29913EPSS 0.5%2022-12-22

    The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.