Filtered by CWE-863
Filtered by vendor Subscriptions
Total 2922 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-12831 1 Arista 1 Ng Firewall 2025-01-03 7.8 High
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the uvm_login module. The issue results from incorrect authorization. An attacker can leverage this to escalate privileges to resources normally protected from the user. Was ZDI-CAN-24324.
CVE-2023-34965 1 Sspanel-uim Project 1 Sspanel-uim 2025-01-03 5.3 Medium
SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information.
CVE-2023-32061 1 Discourse 1 Discourse 2025-01-03 5.4 Medium
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.
CVE-2024-56348 1 Jetbrains 1 Teamcity 2025-01-02 4.3 Medium
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
CVE-2024-56350 1 Jetbrains 1 Teamcity 2025-01-02 4.3 Medium
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
CVE-2022-21894 1 Microsoft 18 Windows 10, Windows 10 1507, Windows 10 1607 and 15 more 2025-01-02 4.4 Medium
Secure Boot Security Feature Bypass Vulnerability
CVE-2023-21560 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2025-01-01 6.6 Medium
Windows Boot Manager Security Feature Bypass Vulnerability
CVE-2022-31644 1 Hp 654 Dragonfly Folio G3 2-in-1, Dragonfly Folio G3 2-in-1 Firmware, Elite Dragonfly and 651 more 2024-12-30 7.8 High
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVE-2022-31646 1 Hp 654 Dragonfly Folio G3 2-in-1, Dragonfly Folio G3 2-in-1 Firmware, Elite Dragonfly and 651 more 2024-12-30 7.8 High
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
CVE-2018-9374 1 Google 2 Android, Pixel 2024-12-18 7.8 High
In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-21270 1 Google 1 Android 2024-12-18 7.8 High
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-28175 1 Bosch 16 Divar Ip 3000, Divar Ip 3000 Firmware, Divar Ip 4000 and 13 more 2024-12-17 7.1 High
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
CVE-2024-24761 1 Galette 1 Galette 2024-12-17 7.5 High
Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue.
CVE-2022-48495 1 Huawei 1 Emui 2024-12-17 5.3 Medium
Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obtained.
CVE-2024-21987 1 Netapp 1 Snapcenter 2024-12-17 5.4 Medium
SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings
CVE-2022-48488 1 Huawei 1 Emui 2024-12-17 5.3 Medium
Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.
CVE-2023-51380 1 Github 1 Enterprise Server 2024-12-16 2.7 Low
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
CVE-2023-51379 1 Github 1 Enterprise Server 2024-12-16 4.9 Medium
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. 
CVE-2024-31134 1 Jetbrains 1 Teamcity 2024-12-16 6.5 Medium
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled
CVE-2024-36365 1 Jetbrains 1 Teamcity 2024-12-16 6.8 Medium
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent