CWE-862 · Missing Authorization (page 55)
Page 55 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12028 | Medium | 5.3 | 2024-12-06 | The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, an… |
CVE-2024-12027 | Medium | 4.3 | 2024-12-06 | The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFi… |
CVE-2024-11323 | High | 8.8 | 2024-12-06 | The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabil… |
CVE-2024-54679 | Medium | 4.3 | 2024-12-05 | CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. |
CVE-2024-11643 | High | 8.8 | 2024-12-04 | The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missi… |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-10567 | High | 7.5 | 2024-12-04 | The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function… |
CVE-2024-10664 | Medium | 4.3 | 2024-12-04 | The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2024-10663 | Medium | 4.3 | 2024-12-04 | The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-42453 | High | 8.1 | 2024-12-04 | A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This inc… |
CVE-2024-11844 | Medium | 4.3 | 2024-12-03 | The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine f… |
CVE-2024-53938 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default and exp… |
CVE-2024-49581 | Medium | 6.5 | 2024-12-02 | Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have per… |
CVE-2024-53784 | Medium | 4.3 | 2024-12-02 | Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access C… |
CVE-2024-53708 | Medium | 5.3 | 2024-12-02 | Missing Authorization vulnerability in kekotron AI Quiz ai-quiz allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AI Quiz: fro… |
CVE-2024-53605 | High | 7.5 | 2024-12-02 | Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows attackers to access s… |
CVE-2024-11918 | Medium | 4.3 | 2024-11-28 | The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and… |
CVE-2017-13316 | High | 7.8 | 2024-11-27 | In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation o… |
CVE-2024-10580 | Medium | 5.3 | 2024-11-27 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability c… |
CVE-2024-11743 | Medium | 4.3 | 2024-11-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of t… |
CVE-2024-8114 | High | 8.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an a… |
CVE-2024-10579 | Medium | 4.3 | 2024-11-26 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… |
CVE-2024-10542 | Critical | 9.8 | 2024-11-26 | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization… |
CVE-2024-49596 | Medium | 5.9 | 2024-11-26 | Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could poten… |
CVE-2024-11673 | Medium | 4.3 | 2024-11-25 | A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processi… |
CVE-2024-53258 | Medium | 5.3 | 2024-11-25 | Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignm… |
CVE-2024-8272 | High | 7.8 | 2024-11-25 | The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process commu… |
CVE-2024-9941 | High | 8.8 | 2024-11-23 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_sta… |
CVE-2024-10606 | Medium | 4.3 | 2024-11-23 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-9223 | Medium | 4.3 | 2024-11-23 | The WPDash Notes plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_ajax_post_it_list_comment' func… |
CVE-2024-10813 | Medium | 5.3 | 2024-11-23 | The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2024-10537 | Medium | 4.3 | 2024-11-23 | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |
CVE-2024-10216 | Medium | 4.3 | 2024-11-23 | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-0138 | Critical | 9.8 | 2024-11-23 | NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to… |
CVE-2024-0122 | High | 7.6 | 2024-11-23 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploi… |
CVE-2024-11601 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin f… |
CVE-2024-11355 | Medium | 4.3 | 2024-11-22 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-11104 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress i… |
CVE-2024-11354 | Medium | 4.3 | 2024-11-21 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-11334 | Medium | 4.3 | 2024-11-21 | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_registros() function i… |
CVE-2024-10532 | Medium | 4.3 | 2024-11-21 | The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtra_import_xml() function… |
CVE-2024-10528 | Medium | 4.3 | 2024-11-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauth… |
CVE-2024-10393 | Medium | 5.3 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the… |
CVE-2018-9477 | High | 7.8 | 2024-11-20 | In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local e… |
CVE-2018-9469 | High | 7.8 | 2024-11-20 | In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check. This could lead to local e… |
CVE-2024-11154 | Medium | 4.3 | 2024-11-20 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2024-10520 | Medium | 5.3 | 2024-11-20 | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the '… |
CVE-2024-45689 | Medium | 6.5 | 2024-11-20 | A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not h… |
CVE-2024-10665 | Medium | 5.4 | 2024-11-20 | The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the… |
CVE-2024-10900 | Medium | 6.5 | 2024-11-20 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-52395 | Medium | 5.3 | 2024-11-19 | Missing Authorization vulnerability in QuantumCloud Floating Buttons for WooCommerce shop-assistant-for-woocommerce-jarvis allows Exploiting Incorrectly Config… |
CVE-2024-51817 | Medium | 5.4 | 2024-11-19 | Missing Authorization vulnerability in CodeZel Combo WP Rewrite Slugs combo-wp-rewrite-slugs allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-51671 | Low | 2.7 | 2024-11-19 | Missing Authorization vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-51660 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in Binsaifullah Easy Accordion Gutenberg Block easy-accordion-block allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-50417 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-49697 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2024-49689 | Medium | 5.4 | 2024-11-19 | Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light hd-quiz-save-results-light allows Exploiting Incorrectly Configured Access… |
CVE-2024-49680 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: fr… |
CVE-2024-11194 | High | 8.8 | 2024-11-19 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr… |
CVE-2024-11069 | Medium | 6.5 | 2024-11-19 | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_… |
CVE-2024-10486 | Medium | 5.3 | 2024-11-18 | The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly ac… |
CVE-2024-10390 | Medium | 6.4 | 2024-11-18 | The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences'… |
CVE-2024-48898 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permiss… |
CVE-2024-52921 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block. |
CVE-2024-52416 | Critical | 10.0 | 2024-11-16 | Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a… |
CVE-2024-10614 | Medium | 4.3 | 2024-11-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() functio… |
CVE-2024-10728 | High | 8.8 | 2024-11-16 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a mis… |
CVE-2024-11085 | Medium | 5.4 | 2024-11-16 | The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all vers… |
CVE-2024-10533 | Medium | 4.3 | 2024-11-16 | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function… |
CVE-2024-10861 | Medium | 5.3 | 2024-11-16 | The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-10786 | Medium | 4.3 | 2024-11-16 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache f… |
CVE-2017-13314 | High | 7.8 | 2024-11-15 | In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to… |
CVE-2021-3987 | Medium | 4.3 | 2024-11-15 | An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public sh… |
CVE-2024-10582 | Medium | 4.3 | 2024-11-15 | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2024-10897 | Medium | 4.3 | 2024-11-15 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_de… |
CVE-2024-52383 | High | 7.5 | 2024-11-14 | Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorr… |
CVE-2024-52382 | Critical | 9.8 | 2024-11-14 | Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a t… |
CVE-2022-31666 | High | 7.7 | 2024-11-14 | Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users… |
CVE-2024-52554 | High | 8.8 | 2024-11-13 | Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed i… |
CVE-2024-52549 | Medium | 4.3 | 2024-11-13 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission c… |
CVE-2024-43090 | Medium | 5.0 | 2024-11-13 | In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User e… |
CVE-2024-43089 | High | 7.8 | 2024-11-13 | In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalat… |
CVE-2024-43088 | High | 7.8 | 2024-11-13 | In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missi… |
CVE-2024-43087 | High | 7.8 | 2024-11-13 | In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility se… |
CVE-2024-40671 | High | 7.8 | 2024-11-13 | In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead… |
CVE-2024-40661 | High | 7.8 | 2024-11-13 | In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This co… |
CVE-2024-34719 | High | 7.8 | 2024-11-13 | In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional… |
CVE-2024-8001 | Medium | 5.3 | 2024-11-13 | A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulati… |
CVE-2024-10800 | High | 8.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function… |
CVE-2024-10575 | Critical | 9.8 | 2024-11-13 | CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected device… |
CVE-2024-10802 | Medium | 5.3 | 2024-11-13 | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_i… |
CVE-2024-10531 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_ass… |
CVE-2024-10530 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_as… |
CVE-2024-10529 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_ass… |
CVE-2024-9578 | Medium | 5.3 | 2024-11-13 | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all v… |
CVE-2024-10854 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buy_one_click_im… |
CVE-2024-10853 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX… |
CVE-2024-10852 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_o… |
CVE-2024-10717 | Medium | 6.5 | 2024-11-13 | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capabi… |