Filtered by CWE-285
Filtered by vendor Subscriptions
Total 717 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22348 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-11-21 4.3 Medium
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.
CVE-2023-21505 1 Samsung 1 Samsung Core Services 2024-11-21 4 Medium
Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.
CVE-2023-21461 1 Samsung 1 Android 2024-11-21 4 Medium
Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via unprotected activity.
CVE-2023-21454 1 Samsung 1 Android 2024-11-21 2.4 Low
Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen.
CVE-2023-21452 1 Samsung 1 Android 2024-11-21 3.3 Low
Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device.
CVE-2023-21440 1 Samsung 1 Android 2024-11-21 6.2 Medium
Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.
CVE-2023-21436 1 Samsung 1 Android 2024-11-21 3.3 Low
Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.
CVE-2023-21433 1 Samsung 1 Galaxy Store 2024-11-21 7.8 High
Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store.
CVE-2023-21432 1 Samsung 1 Smart Things 2024-11-21 4.2 Medium
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner.
CVE-2023-21429 1 Samsung 1 Android 2024-11-21 4 Medium
Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.
CVE-2023-21424 1 Samsung 1 Android 2024-11-21 5.1 Medium
Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values, network code, carrier id and operator brand.
CVE-2023-21423 1 Samsung 1 Android 2024-11-21 5.1 Medium
Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action.
CVE-2023-21422 1 Samsung 1 Android 2024-11-21 5.7 Medium
Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding WifiService.
CVE-2023-20186 1 Cisco 2 Ios, Ios Xe 2024-11-21 8 High
A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy Protocol (SCP). This vulnerability is due to incorrect processing of SCP commands in AAA command authorization checks. An attacker with valid credentials and level 15 privileges could exploit this vulnerability by using SCP to connect to an affected device from an external machine. A successful exploit could allow the attacker to obtain or change the configuration of the affected device and put files on or retrieve files from the affected device.
CVE-2023-20184 1 Cisco 1 Dna Center 2024-11-21 5.4 Medium
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20183 1 Cisco 1 Dna Center 2024-11-21 5.4 Medium
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20182 1 Cisco 1 Dna Center 2024-11-21 5.4 Medium
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2023-20088 1 Cisco 1 Finesse 2024-11-21 5.3 Medium
A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users who are connected through a load balancer. This vulnerability is due to improper IP address filtering by the reverse proxy. An attacker could exploit this vulnerability by sending a series of unauthenticated requests to the reverse proxy. A successful exploit could allow the attacker to cause all current traffic and subsequent requests to the reverse proxy through a load balancer to be dropped, resulting in a DoS condition.
CVE-2023-0914 1 Pixelfed 1 Pixelfed 2024-11-21 5.3 Medium
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CVE-2023-0822 1 Deltaww 1 Diaenergie 2024-11-21 8.8 High
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.