CWE-283 Unverified Ownership
baseThe product does not properly verify that a critical resource is owned by the proper entity.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (37)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-27903US | critical9.8 | — | ||
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact w… | ||||
| CVE-2019-9010US | critical9.8 | — | ||
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODES… | ||||
| CVE-2020-8554US | medium5.0 | Exploit | ||
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Addit… | ||||
| CVE-2026-26016US | high8.1 | — | ||
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers… | ||||
| CVE-2021-24501US | high8.1OT erhöht | — | ||
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifyin… | ||||
| CVE-2021-24500US | high8.1OT erhöht | — | ||
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated.… | ||||
| CVE-2026-83791US | high7.8 | — | ||
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-29788US | high7.5 | — | ||
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, co… | ||||
| CVE-2026-110237US | high7.3 | — | ||
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user… | ||||
| CVE-2026-9745US | medium6.5 | — | ||
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission m… | ||||
| CVE-2022-29220US | medium6.5OT erhöht | — | ||
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not c… | ||||
| CVE-2015-3147US | medium6.5 | — | ||
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or poss… | ||||
| CVE-2026-27486US | medium5.3 | — | ||
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate… | ||||
| CVE-2025-1007US | medium5.3 | — | ||
In OpenVSX version v0.9.0 to v0.20.0, the
/user/namespace/{namespace}/details API allows a user to edit all
namespace details, even if the user is not a namespace Owner or
Contr… | ||||
| CVE-2023-30544US | medium4.3OT erhöht | — | ||
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This pa… | ||||
| CVE-2026-112911US | — | — | ||
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a prot… | ||||
| CVE-2026-93853US | — | — | ||
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot bac… | ||||
| CVE-2025-24890US | — | — | ||
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an ad… | ||||
| CVE-2026-87913US | — | — | ||
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned… | ||||
| CVE-2026-87912US | — | — | ||
A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private sourc… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan