CWE-862
CVEs classified under CWE-862, newest first.
3551 CVEsRSS
CVE-2023-4630Medium· 5.0Missing Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information a…
CVE-2022-20572Medium· 6.7In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no…
CVE-2022-35293Critical· 9.1Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and in…
CVE-2021-44595High· 8.8PoCWondershare Dr
Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM pri…
CVE-2020-25366Critical· 9.1An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
CVE-2020-23735High· 7.8In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability
In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges
CVE-2017-15680Medium· 6.5In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
CVE-2020-29006Critical· 9.8MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
CVE-2020-15412Medium· 4.3An issue was discovered in MISP 2.4.128
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
CVE-2020-14969High· 7.5app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations
app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.
CVE-2019-9482Medium· 5.3In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for
In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received the sighting. The issue affects instances with restrictive sighting settings (…