CWE-862 · Missing Authorization (page 68)
Page 68 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1690 | Medium | 4.3 | 2024-03-13 | The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized acces… |
CVE-2024-1380 | Medium | 5.3 | 2024-03-13 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_l… |
CVE-2024-1370 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hoo… |
CVE-2024-1176 | Medium | 5.3 | 2024-03-13 | The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-1158 | Medium | 4.3 | 2024-03-13 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to un… |
CVE-2024-1127 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-1126 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-0829 | Medium | 4.3 | 2024-03-13 | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is… |
CVE-2024-0828 | Medium | 5.4 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to unauthorized access of functionality due to a mis… |
CVE-2024-0683 | High | 7.3 | 2024-03-13 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versio… |
CVE-2024-0447 | Medium | 5.0 | 2024-03-13 | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-0385 | Medium | 4.3 | 2024-03-13 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxAddCategory funct… |
CVE-2024-0377 | Medium | 5.3 | 2024-03-13 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-0369 | Medium | 4.3 | 2024-03-13 | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2024-2395 | High | 7.3 | 2024-03-12 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to… |
CVE-2024-2107 | Medium | 5.8 | 2024-03-12 | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This make… |
CVE-2024-1137 | Medium | 4.3 | 2024-03-12 | The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Sp… |
CVE-2023-4728 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() function hooked via a… |
CVE-2023-4627 | Medium | 4.3 | 2024-03-12 | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() function in versions… |
CVE-2024-1328 | Medium | 6.4 | 2024-03-12 | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 4.0.14 due… |
CVE-2024-27900 | Medium | 4.3 | 2024-03-12 | Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job template… |
CVE-2024-1645 | Medium | 4.3 | 2024-03-11 | The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all… |
CVE-2024-1400 | Medium | 4.3 | 2024-03-11 | The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in… |
CVE-2024-0052 | Low | 3.3 | 2024-03-11 | In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local informat… |
CVE-2024-1870 | Medium | 4.3 | 2024-03-09 | The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEn… |
CVE-2024-1125 | Medium | 5.4 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the… |
CVE-2024-1124 | Medium | 4.3 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on th… |
CVE-2024-1123 | Medium | 6.5 | 2024-03-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec… |
CVE-2024-2298 | Medium | 4.3 | 2024-03-08 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_impo… |
CVE-2024-1851 | Medium | 6.3 | 2024-03-08 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_crea… |
CVE-2024-23230 | Medium | 5.5 | 2024-03-08 | This issue was addressed with improved file handling. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able… |
CVE-2024-28230 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions |
CVE-2024-1170 | High | 8.2 | 2024-03-07 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to un… |
CVE-2024-1169 | High | 7.5 | 2024-03-07 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to un… |
CVE-2024-28216 | Medium | 5.4 | 2024-03-07 | nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information discl… |
CVE-2024-28215 | High | 7.5 | 2024-03-07 | nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information discl… |
CVE-2024-2216 | High | 8.8 | 2024-03-06 | A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2024-28159 | Medium | 4.3 | 2024-03-06 | A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission to trigger a build. |
CVE-2024-28155 | Medium | 4.3 | 2024-03-06 | Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to ob… |
CVE-2024-1771 | Medium | 4.3 | 2024-03-06 | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in al… |
CVE-2024-1381 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-1285 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-1178 | Medium | 5.3 | 2024-03-05 | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1095 | Medium | 5.3 | 2024-03-05 | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch… |
CVE-2024-1093 | Medium | 5.3 | 2024-03-05 | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function… |
CVE-2024-20032 | Medium | 6.7 | 2024-03-04 | In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-1120 | Medium | 5.3 | 2024-03-01 | The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to u… |
CVE-2024-27950 | Medium | 5.4 | 2024-03-01 | Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-27906 | Medium | 5.9 | 2024-02-29 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permissi… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |
CVE-2024-1982 | Medium | 6.5 | 2024-02-29 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progres… |
CVE-2023-47874 | Medium | 5.4 | 2024-02-29 | Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6. |
CVE-2024-1492 | Medium | 5.3 | 2024-02-29 | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function i… |
CVE-2024-1390 | Medium | 4.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1389 | Medium | 5.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1340 | Medium | 5.4 | 2024-02-29 | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_exp… |
CVE-2024-1337 | Medium | 4.3 | 2024-02-29 | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData'… |
CVE-2024-1322 | Medium | 5.3 | 2024-02-29 | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2024-1318 | Medium | 6.5 | 2024-02-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2024-1288 | Medium | 4.3 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sas… |
CVE-2024-1218 | Medium | 4.3 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API… |
CVE-2024-1217 | High | 7.6 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing ca… |
CVE-2024-1133 | Medium | 4.3 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capab… |
CVE-2024-1130 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1129 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1091 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reini… |
CVE-2024-1090 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopO… |
CVE-2024-1089 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optim… |
CVE-2024-1044 | Medium | 5.3 | 2024-02-29 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_r… |
CVE-2024-1043 | Medium | 6.5 | 2024-02-29 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remov… |
CVE-2024-0984 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disab… |
CVE-2024-0983 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enabl… |
CVE-2024-0907 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-0702 | High | 7.3 | 2024-02-29 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functi… |
CVE-2024-0516 | Medium | 5.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_u… |
CVE-2023-51692 | Medium | 4.3 | 2024-02-28 | Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1. |
CVE-2024-1861 | Medium | 4.3 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1860 | Medium | 6.5 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1566 | Medium | 6.5 | 2024-02-28 | The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in all versions up… |
CVE-2024-1516 | Medium | 5.3 | 2024-02-28 | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() func… |
CVE-2024-1368 | Medium | 5.3 | 2024-02-28 | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() funct… |
CVE-2024-1136 | Medium | 5.3 | 2024-02-28 | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wps… |
CVE-2024-0766 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2024-1388 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in… |
CVE-2024-1653 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosit… |
CVE-2024-1652 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory fun… |
CVE-2024-1650 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory fu… |
CVE-2024-1649 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory fu… |
CVE-2024-1687 | Medium | 5.4 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing… |
CVE-2024-1686 | Medium | 4.3 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and in… |
CVE-2024-1710 | High | 8.8 | 2024-02-26 | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in al… |
CVE-2024-1779 | Medium | 5.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1778 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1053 | Medium | 4.3 | 2024-02-22 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in… |
CVE-2023-4895 | Medium | 4.3 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions star… |
CVE-2024-26138 | Medium | 5.3 | 2024-02-21 | The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.LicenseJSON` that prov… |
CVE-2024-0593 | Medium | 5.3 | 2024-02-21 | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() fun… |
CVE-2024-1562 | Medium | 5.3 | 2024-02-21 | The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute… |
CVE-2024-1108 | Medium | 6.5 | 2024-02-21 | The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all… |