Filtered by CWE-285
Filtered by vendor Subscriptions
Total 1330 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-0757 2 Openstack, Redhat 2 Image Registry And Delivery Service \(glance\), Openstack 2025-04-12 N/A
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
CVE-2016-5788 1 Ge 4 Bently Nevada 3500\/22m Serial, Bently Nevada 3500\/22m Serial Firmware, Bently Nevada 3500\/22m Usb and 1 more 2025-04-12 N/A
General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.
CVE-2014-7300 2 Gnome, Redhat 6 Gnome-shell, Enterprise Linux, Enterprise Linux Desktop and 3 more 2025-04-12 N/A
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
CVE-2016-0922 1 Emc 1 Vipr Srm 2025-04-12 N/A
EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.
CVE-2016-1905 2 Kubernetes, Redhat 2 Kubernetes, Openshift 2025-04-12 N/A
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
CVE-2014-8632 1 Mozilla 2 Firefox, Seamonkey 2025-04-12 N/A
The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper property filtering, which allows remote attackers to bypass intended DOM object restrictions by leveraging property availability after XrayWrapper removal.
CVE-2014-8631 1 Mozilla 2 Firefox, Seamonkey 2025-04-12 N/A
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, which allows remote attackers to bypass intended DOM object restrictions via a call to an unspecified method.
CVE-2015-1000007 1 Wptf-image-gallery Project 1 Wptf-image-gallery 2025-04-12 N/A
Remote file download vulnerability in wptf-image-gallery v1.03
CVE-2016-5404 4 Fedoraproject, Freeipa, Oracle and 1 more 4 Fedora, Freeipa, Linux and 1 more 2025-04-12 N/A
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
CVE-2022-45874 1 Huawei 2 Aslan-al10, Aslan-al10 Firmware 2025-04-11 5.5 Medium
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file.
CVE-2013-1865 3 Canonical, Openstack, Redhat 3 Ubuntu Linux, Folsom, Openstack 2025-04-11 N/A
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
CVE-2013-2113 2 Redhat, Theforeman 2 Openstack, Foreman 2025-04-11 N/A
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
CVE-2022-24894 1 Sensiolabs 1 Symfony 2025-04-10 5.9 Medium
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.
CVE-2022-4804 1 Usememos 1 Memos 2025-04-10 5.3 Medium
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-4688 1 Usememos 1 Memos 2025-04-09 8.8 High
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
CVE-2022-4868 1 Froxlor 1 Froxlor 2025-04-09 4.3 Medium
Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
CVE-2025-2638 1 Jizhicms 1 Jizhicms 2025-04-02 4.3 Medium
A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2637 1 Jizhicms 1 Jizhicms 2025-04-02 4.3 Medium
A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-3740 1 Gitlab 1 Gitlab 2025-04-02 6.5 Medium
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .
CVE-2024-44314 1 Tastyigniter 1 Tastyigniter 2025-04-02 6.5 Medium
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation.