CWE:

	Topic	Date	Author
Med.	OX Documents 7.10.5 Improper Authorization	21.07.2021	Martin Heiland
Med.	CTFd 2.1.5 Administrator Account Takeover	04.01.2020	Social Engineering Neo
Med.	Microsoft Windows Task Scheduler Local Privilege Escalation	22.07.2019	Social Engineering Neo
Med.	Slims CMS Akasia 8.3.1 SQL Injection	22.05.2019	KingSkrupellos
Med.	Slims CMS Akasia 8.3.1 Improper Authorization Vulnerability	19.05.2019	KingSkrupellos
Med.	Dell OpenManage Network Manager 6.2.0.51 SP3 Privilege Escalation	07.11.2018	Matthew Bergin
Low	SAP Business Objects Unauthorized Audit Information Access	26.02.2015	Onapsis
Med.	SAP Business Objects Unauthorized Audit Information Delete	26.02.2015	Onapsis
Low	SAP Business Objects Information Disclosure Via CORBA	09.10.2014	Will Vandevanter
Med.	SAP Business Warehouse Missing Authorization Check	09.10.2014	Will Vandevanter
Med.	SAP Business Objects Denial Of Service Via CORBA	09.10.2014	Will Vandevanter
Med.	Checkpoint Endpoint Security Media Encryption EPM Explorer Bypass	15.11.2013	Pedro Andujar
High	Zoom Telephonics Multiple Vulns	03.09.2013	K Lovett

---

CVEMAP Search Results

CVE

Details

Description

2024-04-18

CVE-2023-3758

Updating...

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

2024-04-10

CVE-2024-1741

Updating...

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.

2024-04-01

CVE-2024-3139

Updating...

A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to this vulnerability.

2024-03-28

CVE-2024-3013

Updating...

A vulnerability was found in FLIR AX8 up to 1.46.16. It has been rated as critical. This issue affects some unknown processing of the file /tools/test_login.php?action=register of the component User Registration. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258299. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2024-03-21

CVE-2024-28029

Updating...

Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.

2024-03-19

CVE-2024-2641

Updating...

A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passwdManage.htm of the component Password Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2024-03-17

CVE-2024-2557

Updating...

A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin.php. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257056. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2024-03-12

CVE-2024-21761

Updating...

An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload.

2024-03-08

CVE-2024-2317

Updating...

A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2024-03-01

CVE-2024-24900

Updating...

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system.

 

---

Copyright 2024, cxsecurity.com