Vulnerabilities (CVE)

Filtered by CWE-285
Total 405 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-5654 1 Facebook 1 React-devtools 2024-11-21 N/A 6.5 MEDIUM
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
CVE-2023-52139 1 Misskey 1 Misskey 2024-11-21 N/A 9.0 CRITICAL
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
CVE-2023-50363 1 Qnap 2 Qts, Quts Hero 2024-11-21 N/A 7.4 HIGH
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
CVE-2023-47166 2024-11-21 N/A 8.8 HIGH
A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability.
CVE-2023-44410 2024-11-21 N/A 8.8 HIGH
D-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the showUsers method. The issue results from the lack of proper authorization before accessing a privileged endpoint. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. . Was ZDI-CAN-19535.
CVE-2023-42491 1 Busbaer 1 Eisbaer Scada 2024-11-21 N/A 8.8 HIGH
EisBaer Scada - CWE-285: Improper Authorization
CVE-2023-42453 2 Fedoraproject, Matrix 2 Fedora, Synapse 2024-11-21 N/A 3.1 LOW
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2023-41819 2024-11-21 N/A 6.1 MEDIUM
A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content providers. 
CVE-2023-41673 1 Fortinet 1 Fortiadc 2024-11-21 N/A 7.1 HIGH
An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
CVE-2023-40683 3 Ibm, Linux, Microsoft 3 Openpages With Watson, Linux Kernel, Windows 2024-11-21 N/A 8.8 HIGH
IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application. IBM X-Force ID: 264005.
CVE-2023-3805 1 Four-faith 1 Video Surveillance Management System 2024-11-21 7.5 HIGH 7.3 HIGH
A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-39403 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-39402 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-39401 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-39400 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-39399 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-39398 1 Huawei 2 Emui, Harmonyos 2024-11-21 N/A 9.1 CRITICAL
Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization.
CVE-2023-38220 1 Adobe 2 Commerce, Magento 2024-11-21 N/A 7.5 HIGH
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.
CVE-2023-38135 1 Intel 1 Performance Maximizer 2024-11-21 N/A 6.7 MEDIUM
Improper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2023-36611 1 Ovarro 10 Tbox Lt2, Tbox Lt2 Firmware, Tbox Ms-cpu32 and 7 more 2024-11-21 N/A 6.5 MEDIUM
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens.