CWE-863: Incorrect Authorization, page 59

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

1. 8.1CVE-2024-21267EPSS 0.4%2024-10-15

   Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.12-12.2.13. Easily exploitable vulnerability allows low privileged attacker with netw…

2. 8.1CVE-2024-21266EPSS 0.4%2024-10-15

   Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network…

3. 8.1CVE-2024-21265EPSS 0.4%2024-10-15

   Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with netwo…

4. 6.5CVE-2024-21262EPSS 0.6%2024-10-15

   Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via …

5. 7.5CVE-2024-21260EPSS 0.7%2024-10-15

   Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …

6. 7.5CVE-2024-21259EPSS 0.3%2024-10-15

   Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows high privileged attacker…

7. 4.3CVE-2024-21249EPSS 0.4%2024-10-15

   Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network acces…

8. 8.7CVE-2024-47876EPSS 0.6%2024-10-15

   Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Vers…

9. 5.8CVE-2024-48911EPSS 0.2%2024-10-14

   OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possib…

10. 7.5CVE-2024-48792EPSS 0.5%2024-10-14

    An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process.

11. 9.1CVE-2024-48772EPSS 0.4%2024-10-11

    An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process.

12. 9.1CVE-2024-48787EPSS 0.5%2024-10-11

    An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process.

13. 9.1CVE-2024-48786EPSS 0.5%2024-10-11

    An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process.

14. 9.8CVE-2024-48784EPSS 0.5%2024-10-11

    An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update process.

15. 9.1CVE-2024-48778EPSS 0.4%2024-10-11

    An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update process.

16. 9.1CVE-2024-48769EPSS 0.4%2024-10-11

    An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process.

17. 8.8CVE-2024-8970EPSS 0.7%2024-10-11

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user u…

18. 6.5CVE-2024-9623EPSS 0.3%2024-10-10

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.

19. 6.5CVE-2024-45132EPSS 0.7%2024-10-10

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to b…

20. 5.4CVE-2024-45131EPSS 0.5%2024-10-10

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability…

21. 5.4CVE-2024-45128EPSS 0.6%2024-10-10

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability…

22. 4.3CVE-2024-45125EPSS 0.5%2024-10-10

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability…

23. 5.4CVE-2024-7048EPSS 0.4%2024-10-10

    In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files ma…

24. 9.1CVE-2024-45160EPSS 0.5%2024-10-09

    Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).

25. 4.3CVE-2024-47780EPSS 0.3%2024-10-08

    TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but …

26. 6.1CVE-2024-38425EPSS 0.1%2024-10-07

    Information disclosure while sending implicit broadcast containing APP launch information.

27. 8.1CVE-2024-47183EPSS 0.4%2024-10-04

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object I…

28. 6.8CVE-2024-47616EPSS 0.6%2024-10-02

    Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON …

29. 7.8CVE-2024-47560EPSS 0.2%2024-10-01

    RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox en…

30. 5.4CVE-2024-47172EPSS 0.3%2024-09-30

    Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT …

31. 6.5CVE-2024-47077EPSS 0.4%2024-09-27

    authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a us…

32. 7.5CVE-2024-9136EPSS 0.2%2024-09-27

    Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

33. 4.3CVE-2024-8974EPSS 0.3%2024-09-26

    Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private projec…

34. 4.3CVE-2024-9155EPSS 0.3%2024-09-26

    Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

35. 8.2CVE-2024-7108EPSS 0.3%2024-09-26

    Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CyberMath: before CYBM.240816253.

36. 9.3CVE-2024-20510EPSS 0.3%2024-09-25

    A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent attacker to bypass the pre-authentication access control list (ACL), which could all…

37. 9.8CVE-2024-47078EPSS 0.5%2024-09-25

    Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied t…

38. 3.3CVE-2023-25189EPSS 0.1%2024-09-25

    BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, regardless of the access privileges, having a possibility to read BTS service operation details perform…

39. 6.5CVE-2024-6512EPSS 0.3%2024-09-25

    Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM …

40. 9.3CVE-2024-6593EPSS 0.6%2024-09-25

    Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network…

41. 9.3CVE-2024-6592EPSS 1.2%2024-09-25

    An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker wit…

42. 9.2CVE-2024-8606EPSS 0.5%2024-09-23

    Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication

43. 5.3CVE-2024-9082EPSS 0.5%2024-09-22

    A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The mani…

44. 6.5CVE-2024-47060EPSS 0.4%2024-09-20

    Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access…

45. 5.3CVE-2024-47160EPSS 0.4%2024-09-19

    In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible

46. 4.3CVE-2024-47159EPSS 0.3%2024-09-19

    In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project

47. 7.8CVE-2024-44162EPSS 0.2%2024-09-17

    This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.

48. 5.5CVE-2024-40843EPSS 0.2%2024-09-17

    The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system.

49. 7.5CVE-2024-40770EPSS 0.5%2024-09-17

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.

50. 4.9CVE-2024-46918EPSS 0.4%2024-09-15

    app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.