cve.bz

CWE-863: Incorrect Authorization, page 69

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-34147EPSS 0.2%

    An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affe…

  2. 7.8CVE-2023-34146EPSS 0.2%

    An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affe…

  3. 8.8CVE-2023-35165EPSS 0.9%

    AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks…

  4. 7.8CVE-2023-32353EPSS 0.7%

    A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges.

  5. 7.7CVE-2023-3114EPSS 0.4%

    Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resour…

  6. 8.1CVE-2023-34923EPSS 0.7%

    XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation.

  7. 7.5CVE-2023-29708EPSS 14%

    An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload.

  8. 8.8CVE-2023-0971EPSS 0.2%

    A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.

  9. 8.8CVE-2023-35166EPSS 62%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched…

  10. 7.5CVE-2023-34161EPSS 0.4%

    nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability may cause features to perform abnormally.

  11. 5.3CVE-2022-48495EPSS 0.3%

    Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obtained.

  12. 5.3CVE-2022-48488EPSS 0.3%

    Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.

  13. 5.5CVE-2023-35866EPSS 0.2%

    In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authentica…

  14. 7.8CVE-2023-25185EPSS 0.1%

    An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have un…

  15. 4.3CVE-2023-29296EPSS 0.6%

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverag…

  16. 4.3CVE-2023-29295EPSS 0.6%

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverag…

  17. 4.3CVE-2023-29288EPSS 0.6%

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage th…

  18. 7.5CVE-2023-22248EPSS 1.0%

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnera…

  19. 7.7CVE-2023-28175EPSS 0.5%

    Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.

  20. 7.8CVE-2022-22307EPSS 0.2%

    IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.

  21. 7.8CVE-2022-31646EPSS 0.2%

    Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.

  22. 7.8CVE-2022-31644EPSS 0.2%

    Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.

  23. 5.3CVE-2023-32061EPSS 0.4%

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to e…

  24. 8.1CVE-2023-24546EPSS 0.5%

    On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration da…

  25. 5.3CVE-2023-34965EPSS 0.9%

    SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information.

  26. 9.8CVE-2023-32220EPSS 0.6%

    Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.

  27. 7.5CVE-2023-32219EPSS 0.5%

    A Mazda model (2015-2016) can be unlocked via an unspecified method.

  28. 9.8CVE-2023-27716EPSS 0.7%

    An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.

  29. 7.8CVE-2023-29766EPSS 0.3%

    An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the database files.

  30. 5.5CVE-2023-29761EPSS 0.3%

    An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.

  31. 5.5CVE-2023-29759EPSS 0.3%

    An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files.

  32. 5.5CVE-2023-29758EPSS 0.3%

    An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.

  33. 7.8CVE-2023-29752EPSS 0.4%

    An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.

  34. 8.8CVE-2023-32749ExploitEPSS 14%

    Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By ass…

  35. 4.3CVE-2023-34958EPSS 0.4%

    Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.

  36. 5.3CVE-2021-4352EPSS 0.8%

    The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated at…

  37. 7.5CVE-2020-36710EPSS 0.8%

    The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in vers…

  38. 7.5CVE-2023-33651EPSS 1.4%

    An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

  39. 5.4CVE-2023-32683EPSS 0.6%

    Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network…

  40. 6.5CVE-2023-22833EPSS 0.4%

    Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users within a Foundry organization to bypass discretionary or mandatory access controls under certain circums…

  41. 4.3CVE-2023-1779EPSS 0.5%

    Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges …

  42. 7.8CVE-2023-21670EPSS 0.1%

    Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

  43. 7.8CVE-2022-40529EPSS 0.10%

    Memory corruption due to improper access control in kernel while processing a mapping request from root process.

  44. 7.8CVE-2023-3027EPSS 0.2%

    The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage…

  45. 8.1CVE-2023-3066EPSS 0.6%

    Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.

  46. 4.3CVE-2023-25749EPSS 0.4%

    Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so…

  47. 8.8CVE-2023-25729EPSS 0.7%

    Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further mal…

  48. 6.5CVE-2023-23604EPSS 0.5%

    A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.

  49. 8.8CVE-2023-3033EPSS 0.6%

    Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.

  50. 9.8CVE-2023-28698EPSS 0.8%

    Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system oper…