CWE-639
1,770 CVEs • Abstraction: Base • Likelihood of Exploit: High
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVEs (1,770)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. |
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. |
Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59...Show more |
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Com...Show more |