CWE-862 · Missing Authorization (page 60)
Page 60 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39824 | Medium | 4.9 | 2024-08-14 | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure… |
CVE-2024-39823 | Medium | 4.9 | 2024-08-14 | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure… |
CVE-2024-38699 | High | 7.5 | 2024-08-13 | Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2024-37935 | High | 7.5 | 2024-08-13 | Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommer… |
CVE-2024-42373 | Medium | 4.3 | 2024-08-13 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-41734 | Medium | 4.3 | 2024-08-13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction… |
CVE-2024-39591 | Medium | 4.3 | 2024-08-13 | SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact o… |
CVE-2024-42377 | Medium | 4.3 | 2024-08-13 | SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries i… |
CVE-2024-42376 | Medium | 6.5 | 2024-08-13 | SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exp… |
CVE-2024-41730 | Critical | 9.8 | 2024-08-13 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token… |
CVE-2024-33005 | Medium | 6.3 | 2024-08-13 | Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP… |
CVE-2024-37930 | Medium | 5.3 | 2024-08-12 | Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMa… |
CVE-2024-7648 | Medium | 4.3 | 2024-08-12 | The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes func… |
CVE-2024-7621 | Medium | 5.4 | 2024-08-12 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
CVE-2024-6760 | High | 7.5 | 2024-08-12 | A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users… |
CVE-2024-42470 | Medium | 6.5 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4… |
CVE-2024-42035 | High | 8.4 | 2024-08-08 | Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality. |
CVE-2024-6824 | Medium | 4.3 | 2024-08-08 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'che… |
CVE-2024-6987 | Medium | 4.3 | 2024-08-08 | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin'… |
CVE-2024-6869 | Medium | 5.4 | 2024-08-08 | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several fun… |
CVE-2024-43045 | Medium | 6.3 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to… |
CVE-2024-6872 | Medium | 4.3 | 2024-08-03 | The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – Templat… |
CVE-2024-6709 | Medium | 4.3 | 2024-08-03 | The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_… |
CVE-2024-7031 | High | 7.5 | 2024-08-03 | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSe… |
CVE-2024-5331 | Medium | 4.3 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authen… |
CVE-2024-6698 | High | 8.8 | 2024-08-01 | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly v… |
CVE-2024-41108 | High | 7.5 | 2024-07-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's… |
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-37898 | Medium | 4.3 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in X… |
CVE-2024-7135 | Medium | 6.5 | 2024-07-31 | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up… |
CVE-2024-2508 | Medium | 5.3 | 2024-07-31 | The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon functio… |
CVE-2024-40834 | Medium | 4.4 | 2024-07-29 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8… |
CVE-2024-41624 | Medium | 6.3 | 2024-07-29 | Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact. |
CVE-2024-6458 | Medium | 6.4 | 2024-07-27 | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_pre… |
CVE-2024-6591 | Medium | 5.8 | 2024-07-27 | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 's… |
CVE-2024-4410 | Medium | 5.4 | 2024-07-27 | The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to miss… |
CVE-2024-1804 | Medium | 4.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_fr… |
CVE-2024-1798 | Medium | 5.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml f… |
CVE-2024-6836 | Medium | 4.3 | 2024-07-24 | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPres… |
CVE-2024-5861 | Medium | 5.3 | 2024-07-24 | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_squa… |
CVE-2024-6755 | Medium | 6.5 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_post… |
CVE-2024-6754 | Medium | 5.4 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_twe… |
CVE-2024-6750 | High | 7.3 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple… |
CVE-2024-6806 | Critical | 9.8 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code ex… |
CVE-2024-6805 | High | 7.5 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in informat… |
CVE-2024-6636 | Critical | 9.8 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_… |
CVE-2024-6491 | Medium | 4.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_ke… |
CVE-2024-6489 | Medium | 5.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_k… |
CVE-2024-6799 | Medium | 4.3 | 2024-07-19 | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'act… |
CVE-2023-7268 | Medium | 6.5 | 2024-07-19 | The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as… |
CVE-2024-5997 | Medium | 4.3 | 2024-07-18 | The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-6455 | Medium | 5.3 | 2024-07-18 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capabi… |
CVE-2024-6599 | Medium | 4.3 | 2024-07-18 | The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings fun… |
CVE-2024-6175 | Medium | 5.4 | 2024-07-18 | The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-5703 | Medium | 4.3 | 2024-07-17 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-6660 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data tha… |
CVE-2024-6033 | Medium | 4.3 | 2024-07-17 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capab… |
CVE-2024-6621 | Medium | 4.3 | 2024-07-16 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… |
CVE-2024-6579 | Medium | 4.3 | 2024-07-16 | The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability… |
CVE-2024-1937 | High | 7.1 | 2024-07-16 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' functio… |
CVE-2024-6465 | Medium | 4.3 | 2024-07-13 | The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplf_ajax_update_screenshot… |
CVE-2024-37544 | Medium | 4.3 | 2024-07-12 | Missing Authorization vulnerability in Saleswonder Team: Tobias Get Better Reviews for WooCommerce more-better-reviews-for-woocommerce.This issue affects Get B… |
CVE-2024-37202 | Medium | 6.5 | 2024-07-12 | Missing Authorization vulnerability in BinaryCarpenter Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-… |
CVE-2024-6328 | Critical | 9.8 | 2024-07-12 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-6392 | Medium | 5.4 | 2024-07-11 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on… |
CVE-2024-39546 | High | 7.3 | 2024-07-11 | A Missing Authorization vulnerability in the Socket Intercept (SI) command file interface of Juniper Networks Junos OS Evolved allows an authenticated, low-pri… |
CVE-2024-0619 | Medium | 5.3 | 2024-07-11 | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback()… |
CVE-2024-38353 | Medium | 5.3 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing a… |
CVE-2024-5677 | Medium | 4.3 | 2024-07-10 | The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_i… |
CVE-2024-21417 | High | 8.8 | 2024-07-10 | Windows Text Services Framework Elevation of Privilege Vulnerability |
CVE-2024-31332 | High | 7.8 | 2024-07-09 | In multiple locations, there is a possible way to bypass a restriction on adding new Wi-Fi connections due to a missing permission check. This could lead to lo… |
CVE-2024-31318 | High | 7.8 | 2024-07-09 | In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permission check. This could… |
CVE-2024-6167 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions i… |
CVE-2024-6069 | High | 8.8 | 2024-07-09 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2024-5993 | Medium | 5.4 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' functio… |
CVE-2024-5992 | Medium | 6.5 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' a… |
CVE-2024-5856 | Medium | 4.3 | 2024-07-09 | The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX acti… |
CVE-2024-5704 | Medium | 4.3 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
CVE-2024-5669 | Medium | 6.4 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a miss… |
CVE-2024-5648 | Medium | 5.4 | 2024-07-09 | The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e… |
CVE-2024-5600 | Medium | 5.4 | 2024-07-09 | The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability… |
CVE-2024-4102 | Medium | 5.4 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up… |
CVE-2024-3608 | Medium | 5.3 | 2024-07-09 | The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_atta… |
CVE-2024-6180 | High | 7.2 | 2024-07-09 | The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax act… |
CVE-2024-39596 | Medium | 4.3 | 2024-07-09 | Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On succ… |
CVE-2024-37175 | Medium | 4.3 | 2024-07-09 | SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker… |
CVE-2024-37172 | Medium | 5.4 | 2024-07-09 | SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileg… |
CVE-2024-39592 | High | 7.7 | 2024-07-09 | Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker t… |
CVE-2024-5855 | Medium | 4.3 | 2024-07-09 | The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o… |
CVE-2024-4341 | Medium | 6.5 | 2024-07-08 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. Thi… |
CVE-2024-37542 | Medium | 5.4 | 2024-07-06 | Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a th… |
CVE-2024-37903 | High | 8.2 | 2024-07-05 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities… |
CVE-2024-5641 | Medium | 6.4 | 2024-07-04 | The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_ge… |
CVE-2024-36113 | Medium | 4.9 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.bet… |
CVE-2024-6088 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register'… |
CVE-2024-6012 | Medium | 4.3 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page… |
CVE-2024-5545 | Medium | 5.3 | 2024-07-02 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-36995 | Medium | 5.4 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that… |
CVE-2024-6375 | Medium | 5.4 | 2024-07-01 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degra… |
CVE-2024-5570 | Medium | 6.5 | 2024-06-28 | The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, suc… |