CWE-862 · Missing Authorization (page 58)
Page 58 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50573 | Medium | 4.3 | 2024-10-28 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services |
CVE-2024-10402 | High | 7.5 | 2024-10-26 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-10092 | Medium | 4.3 | 2024-10-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actio… |
CVE-2024-9626 | Medium | 4.3 | 2024-10-26 | The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta… |
CVE-2024-9584 | Medium | 5.4 | 2024-10-25 | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functi… |
CVE-2024-9630 | Medium | 5.4 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, a… |
CVE-2024-9628 | Medium | 6.3 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Te… |
CVE-2024-9109 | Medium | 4.3 | 2024-10-25 | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-9686 | Medium | 5.3 | 2024-10-25 | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfw_s… |
CVE-2024-49357 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in Zi… |
CVE-2024-48932 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1… |
CVE-2024-48538 | Critical | 9.8 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the cod… |
CVE-2024-49683 | Medium | 5.3 | 2024-10-24 | Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Pro… |
CVE-2024-9531 | Medium | 4.3 | 2024-10-24 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-8667 | Medium | 4.3 | 2024-10-24 | The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to… |
CVE-2024-49657 | High | 7.7 | 2024-10-23 | Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control S… |
CVE-2024-43924 | Medium | 5.3 | 2024-10-23 | Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsi… |
CVE-2024-9583 | Medium | 4.3 | 2024-10-23 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a mi… |
CVE-2024-9829 | Medium | 6.5 | 2024-10-23 | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' an… |
CVE-2024-38002 | Critical | 9.0 | 2024-10-22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through upda… |
CVE-2024-10003 | Medium | 6.3 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2024-48645 | High | 7.5 | 2024-10-21 | In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "function" files used by th… |
CVE-2024-49367 | High | 7.5 | 2024-10-21 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined… |
CVE-2024-49321 | Medium | 4.3 | 2024-10-21 | Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Contro… |
CVE-2024-49293 | Medium | 4.3 | 2024-10-21 | Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: fr… |
CVE-2024-49273 | Medium | 4.3 | 2024-10-21 | Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities.This issue affects ProfileGrid : from n/a throug… |
CVE-2024-49325 | Medium | 4.3 | 2024-10-20 | Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.T… |
CVE-2024-10078 | Medium | 6.3 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple… |
CVE-2024-9364 | Medium | 4.3 | 2024-10-18 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' fu… |
CVE-2024-9361 | Medium | 4.3 | 2024-10-18 | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-20463 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-45461 | Medium | 5.7 | 2024-10-16 | The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environ… |
CVE-2020-36840 | High | 7.3 | 2024-10-16 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route… |
CVE-2023-7294 | High | 7.1 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the cre… |
CVE-2023-7293 | Medium | 4.3 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_… |
CVE-2023-7292 | Medium | 4.3 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on th… |
CVE-2023-7291 | High | 7.1 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2023-7290 | Medium | 4.3 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_… |
CVE-2023-7289 | Medium | 5.4 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytiu… |
CVE-2023-7288 | Medium | 5.4 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the upd… |
CVE-2023-7287 | Medium | 5.4 | 2024-10-16 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2022-4972 | High | 7.5 | 2024-10-16 | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporti… |
CVE-2021-4448 | High | 7.3 | 2024-10-16 | The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability… |
CVE-2021-4447 | High | 8.8 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restricti… |
CVE-2021-4446 | Medium | 6.3 | 2024-10-16 | The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability c… |
CVE-2021-4445 | Medium | 6.5 | 2024-10-16 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing… |
CVE-2021-4444 | High | 7.3 | 2024-10-16 | The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization c… |
CVE-2020-36837 | Critical | 9.9 | 2024-10-16 | The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function… |
CVE-2020-36835 | Medium | 4.9 | 2024-10-16 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing c… |
CVE-2020-36834 | Medium | 6.3 | 2024-10-16 | The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2… |
CVE-2020-36833 | Medium | 6.3 | 2024-10-16 | The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 -… |
CVE-2020-36831 | Medium | 5.0 | 2024-10-16 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privi… |
CVE-2019-25217 | Critical | 9.8 | 2024-10-16 | The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to… |
CVE-2019-25215 | High | 7.3 | 2024-10-16 | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions… |
CVE-2019-25214 | High | 7.2 | 2024-10-16 | The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and inclu… |
CVE-2018-25105 | Critical | 9.8 | 2024-10-16 | The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and… |
CVE-2024-9891 | Medium | 4.3 | 2024-10-16 | The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the m… |
CVE-2024-38190 | High | 8.6 | 2024-10-15 | Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. |
CVE-2024-21254 | High | 8.8 | 2024-10-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0 an… |
CVE-2024-21252 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.13… |
CVE-2024-21250 | High | 8.1 | 2024-10-15 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specification). Supported… |
CVE-2024-21246 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12… |
CVE-2024-21234 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21216 | Critical | 9.8 | 2024-10-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21215 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-45732 | High | 7.1 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 an… |
CVE-2024-9756 | Medium | 4.3 | 2024-10-12 | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on th… |
CVE-2024-9824 | Medium | 4.3 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_de… |
CVE-2024-9187 | Medium | 4.3 | 2024-10-12 | The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm() function in all versi… |
CVE-2024-9860 | Medium | 5.4 | 2024-10-12 | The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action… |
CVE-2024-9707 | Critical | 9.8 | 2024-10-11 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/th… |
CVE-2024-9587 | Medium | 5.4 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions… |
CVE-2024-9586 | Medium | 6.5 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' f… |
CVE-2024-9234 | Critical | 9.8 | 2024-10-11 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a mi… |
CVE-2024-48902 | Medium | 5.4 | 2024-10-10 | In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API |
CVE-2024-9520 | Medium | 6.3 | 2024-10-10 | The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2024-9067 | Medium | 4.3 | 2024-10-10 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modificat… |
CVE-2024-9685 | Medium | 4.3 | 2024-10-10 | The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_actio… |
CVE-2024-9065 | Medium | 5.3 | 2024-10-10 | The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_smtp_send_mail_test… |
CVE-2024-8513 | Medium | 5.3 | 2024-10-10 | The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data d… |
CVE-2024-9671 | Medium | 5.3 | 2024-10-09 | A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the… |
CVE-2024-42934 | Medium | 5.0 | 2024-10-09 | OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low… |
CVE-2024-38179 | High | 8.8 | 2024-10-08 | Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability |
CVE-2024-8431 | Medium | 4.3 | 2024-10-08 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-9161 | Medium | 6.5 | 2024-10-05 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing cap… |
CVE-2024-47768 | High | 8.1 | 2024-10-04 | Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system whe… |
CVE-2024-47790 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of insecure Real-Time Streaming Protocol (RTSP) version… | |
CVE-2024-20477 | Medium | 5.4 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an aff… |
CVE-2024-20442 | Medium | 5.4 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrat… |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-8430 | Medium | 5.3 | 2024-10-01 | The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_im… |
CVE-2024-8675 | Medium | 4.3 | 2024-10-01 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway… |
CVE-2024-8632 | Medium | 6.5 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing cap… |
CVE-2024-8548 | High | 8.1 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capab… |
CVE-2024-9297 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-9189 | Medium | 5.3 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_e… |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-8771 | Medium | 4.3 | 2024-09-26 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-9025 | Medium | 5.3 | 2024-09-26 | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |