CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0834
https://notcve.org/view.php?id=CVE-2023-0834
28 Apr 2023 — Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1. • https://www.hypr.com/security-advisories • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3258
https://notcve.org/view.php?id=CVE-2022-3258
03 Nov 2022 — Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. Una vulnerabilidad de Asignación Incorrecta de Permisos para Recursos Críticos en HYPR Workforce Access en Windows permite un Abuso de la Autenticación. • https://www.hypr.com/security-advisories • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2193
https://notcve.org/view.php?id=CVE-2022-2193
19 Jul 2022 — Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1. Una vulnerabilidad de Referencia Directa de Objetos no Segura en HYPR Server versiones anteriores a 6.14.1 permite a atacantes remotos autenticados añadir un autenticador FIDO2 a cuentas arbitrarias por medio de la manipulación d... • https://www.hypr.com/security-advisories • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1984
https://notcve.org/view.php?id=CVE-2022-1984
19 Jul 2022 — This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow local authenticated attackers to elevate privileges via a malicious serialized payload. Este problema afecta a: HYPR Windows WFA versiones anteriores a 7.2; Una vulnerabilidad de Deserialización no Segura en HYPR Workforce Access (WFA) versiones anteriores a 7.2, puede permitir a atacantes locales autenticados elevar los privilegios por medio de una car... • https://www.hypr.com/security-advisories • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2192
https://notcve.org/view.php?id=CVE-2022-2192
19 Jul 2022 — Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions. Una vulnerabilidad de navegación forzada en HYPR Server versiones 6.10 a 6.15.1, permite a atacantes remotos con un token válido de recuperación de un solo uso elevar los privilegios por medio de la manipulación de la ruta en... • https://www.hypr.com/security-advisories • CWE-425: Direct Request ('Forced Browsing') •