The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,098 vulnerabilities with CWE-863
CVE-2022-20558
LOW
Android 13 - Incorrect Authorization in DeviceCapabilityListener
CVSS 3.3
CVE-2022-41962
LOW
BigBlueButton < 2.4-rc-6 and 2.5-alpha-1 - Authenticated Incorrect Authorization in Emoji Status Feature
CVSS 2.7
CVE-2022-23741
HIGH
GitHub Enterprise Server < 3.3.17 - Incorrect Authorization via Scoped User-to-Server Token
CVSS 7.2
CVE-2022-46160
MEDIUM
Tuleap <14.2.99.104 - Info Disclosure
CVSS 4.3
CVE-2022-23473
MEDIUM
Tuleap < 14.2.99.148 - Incorrect Authorization in MediaWiki Standalone Plugin
CVSS 4.3
CVE-2022-41274
MEDIUM
SAP Disclosure Mgmt <10.1 - Info Disclosure
CVSS 6.5
CVE-2022-3883
MEDIUM
stopbadbots < 7.24 - Authenticated Arbitrary Plugin Installation via AJAX Action
CVSS 6.5
CVE-2022-3882
MEDIUM
wp-memory < 2.46 - Authenticated Arbitrary Plugin Installation via CSRF
CVSS 6.5
CVE-2022-3881
MEDIUM
WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascri...
CVSS 5.7
CVE-2022-3880
MEDIUM
antihacker < 4.20 - Authenticated Plugin Installation via AJAX Action
CVSS 6.5
CVE-2022-3879
MEDIUM
Car Dealer WordPress Plugin < 3.05 - Authenticated Arbitrary Plugin Installation via AJAX Action
CVSS 6.5
CVE-2022-45956
MEDIUM
Boa 0.94.13-0.94.14 - Authentication Bypass via HEAD HTTP Method
CVSS 5.3
CVE-2022-45760
HIGH
SENS v1.0 - Incorrect Access Control
CVSS 8.8
CVE-2022-4397
MEDIUM
zend-blog-2 - Cross-Site Request Forgery in Comment Handler
CVSS 4.3
CVE-2022-39914
MEDIUM
Android < 13.0 - Unauthorized Sensitive Information Exposure via DisplayManagerService
CVSS 4.0
CVE-2022-39913
MEDIUM
Android < 13.0 - Exposure of Sensitive Information via Persona Manager
CVSS 6.8
CVE-2022-39903
MEDIUM
Android - Exposure of Sensitive Information via RCS Call Access Control
CVSS 4.0
CVE-2022-4349
MEDIUM
CTF-hacker pwn - Cross-Site Request Forgery in delete.html
CVSS 4.3
CVE-2022-46792
HIGH
Hasura GraphQL Engine <2.15.2 - Info Disclosure
CVSS 8.8
CVE-2022-46169
CRITICAL
KEV
Cacti 1.2.22 unauthenticated command injection
CVSS 9.8
CVE-2022-44039
CRITICAL
Franklin Fueling System FFS Colibri 1.9.22.8925 - Privilege Escalation
CVSS 9.8
CVE-2022-43515
MEDIUM
Zabbix Frontend 4.0.0-4.0.43 - Unauthenticated IP Restriction Bypass
CVSS 5.3
CVE-2022-46167
HIGH
Capsule <0.1.3 - Privilege Escalation
CVSS 8.8
CVE-2022-41970
LOW
Nextcloud Server < 24.0.7 and 25.0.1 - Improper Access Control via Preview Image Download
CVSS 2.6
CVE-2022-24189
MEDIUM
Ourphoto 1.4.1 - Incorrect Authorization via Missing User Token
CVSS 6.5
Details
Vulnerabilities
3,098
Exploit Likelihood
High