CWE-862 · Missing Authorization (page 69)
Page 69 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0038 | High | 7.8 | 2024-02-16 | In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. Th… |
CVE-2024-0037 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could le… |
CVE-2023-40113 | Medium | 5.5 | 2024-02-15 | In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead to local informati… |
CVE-2023-40105 | Medium | 5.5 | 2024-02-15 | In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to loca… |
CVE-2023-26562 | Medium | 6.5 | 2024-02-13 | In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp. |
CVE-2024-25643 | Medium | 4.3 | 2024-02-13 | The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an esc… |
CVE-2024-24741 | Medium | 4.3 | 2024-02-13 | SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an… |
CVE-2024-24739 | Medium | 6.3 | 2024-02-13 | SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low im… |
CVE-2024-0596 | Medium | 5.3 | 2024-02-10 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o… |
CVE-2024-0595 | Medium | 4.3 | 2024-02-10 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp… |
CVE-2024-1122 | Medium | 5.3 | 2024-02-09 | The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2023-6840 | Medium | 6.7 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maint… |
CVE-2024-24822 | Medium | 6.5 | 2024-02-07 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having t… |
CVE-2024-1110 | Medium | 5.3 | 2024-02-07 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function… |
CVE-2024-1109 | Medium | 5.3 | 2024-02-07 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and in… |
CVE-2024-1079 | Medium | 5.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all ve… |
CVE-2024-1078 | Medium | 4.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_start() and add_quest… |
CVE-2024-1177 | Medium | 5.3 | 2024-02-05 | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-1121 | Medium | 5.3 | 2024-02-05 | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() functi… |
CVE-2024-1092 | Medium | 4.3 | 2024-02-05 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modifi… |
CVE-2024-1072 | High | 8.2 | 2024-02-05 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-0869 | High | 8.8 | 2024-02-05 | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options… |
CVE-2024-0835 | Medium | 4.3 | 2024-02-05 | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler… |
CVE-2024-0797 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of fun… |
CVE-2024-0791 | Medium | 4.3 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to… |
CVE-2024-0372 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2024-0371 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0370 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2023-6985 | Medium | 6.5 | 2024-02-05 | The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2023-6959 | Medium | 4.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_ke… |
CVE-2023-6700 | High | 8.8 | 2024-02-05 | The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJA… |
CVE-2023-6557 | Medium | 5.3 | 2024-02-05 | The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route functi… |
CVE-2023-4637 | Medium | 4.3 | 2024-02-05 | The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() fun… |
CVE-2023-47148 | Medium | 5.3 | 2024-02-02 | IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation… |
CVE-2024-1047 | Medium | 5.3 | 2024-02-02 | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-0836 | Medium | 4.3 | 2024-01-31 | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2023-22836 | Low | 3.5 | 2024-01-29 | In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may… |
CVE-2023-1705 | High | 8.4 | 2024-01-29 | Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality… |
CVE-2023-6279 | High | 7.1 | 2024-01-29 | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to… |
CVE-2024-23388 | Medium | 6.1 | 2024-01-26 | Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to a… |
CVE-2023-5612 | Medium | 5.3 | 2024-01-26 | An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user e… |
CVE-2024-21630 | Medium | 4.3 | 2024-01-25 | Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-… |
CVE-2024-0617 | Medium | 5.3 | 2024-01-25 | The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_di… |
CVE-2023-50944 | Medium | 6.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have acces… |
CVE-2024-23752 | Critical | 9.8 | 2024-01-22 | GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that… |
CVE-2024-0679 | Medium | 6.5 | 2024-01-20 | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all version… |
CVE-2023-48339 | Medium | 4.4 | 2024-01-18 | In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed |
CVE-2022-42884 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7. |
CVE-2022-41790 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. |
CVE-2022-41786 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a thr… |
CVE-2023-23896 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17. |
CVE-2023-23882 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite… |
CVE-2022-41695 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5. |
CVE-2022-41619 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8. |
CVE-2022-40702 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1… |
CVE-2023-34379 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration… |
CVE-2022-40203 | Medium | 6.3 | 2024-01-17 | Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a… |
CVE-2022-38141 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8. |
CVE-2022-36418 | Medium | 6.5 | 2024-01-17 | Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0. |
CVE-2023-48926 | Medium | 5.3 | 2024-01-16 | An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order… |
CVE-2024-0238 | Medium | 6.1 | 2024-01-16 | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that… |
CVE-2024-0237 | Medium | 5.3 | 2024-01-16 | The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated user… |
CVE-2024-0236 | Medium | 5.3 | 2024-01-16 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to… |
CVE-2024-0235 | Medium | 5.3 | 2024-01-16 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to… |
CVE-2022-23180 | Medium | 4.3 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated u… |
CVE-2024-0570 | High | 7.3 | 2024-01-16 | A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2024-0569 | Medium | 4.3 | 2024-01-16 | A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cs… |
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2023-6066 | Medium | 4.3 | 2024-01-15 | The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, whic… |
CVE-2023-6048 | Medium | 6.5 | 2024-01-15 | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the s… |
CVE-2023-6029 | High | 7.5 | 2024-01-15 | The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from… |
CVE-2023-5905 | High | 8.1 | 2024-01-15 | The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allo… |
CVE-2023-6955 | Medium | 6.6 | 2024-01-12 | A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to… |
CVE-2023-40362 | Medium | 4.3 | 2024-01-12 | An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrari… |
CVE-2023-6554 | Medium | 6.5 | 2024-01-11 | When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download pr… |
CVE-2023-7019 | Medium | 4.3 | 2024-01-11 | The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2023-6875 | Critical | 9.8 | 2024-01-11 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of… |
CVE-2023-6855 | Medium | 5.3 | 2024-01-11 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of memb… |
CVE-2023-6751 | High | 7.3 | 2024-01-11 | The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in al… |
CVE-2023-6742 | Medium | 4.3 | 2024-01-11 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability c… |
CVE-2023-6638 | Medium | 6.5 | 2024-01-11 | The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_sett… |
CVE-2023-6637 | Medium | 6.5 | 2024-01-11 | The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'upda… |
CVE-2023-6598 | Medium | 4.3 | 2024-01-11 | The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, sp… |
CVE-2023-6504 | Medium | 4.3 | 2024-01-11 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of dat… |
CVE-2023-6496 | Medium | 5.3 | 2024-01-11 | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_expo… |
CVE-2023-6369 | Medium | 5.4 | 2024-01-11 | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability ch… |
CVE-2023-6883 | Medium | 4.3 | 2024-01-11 | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in al… |
CVE-2023-6158 | Medium | 6.5 | 2024-01-10 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing… |
CVE-2023-48247 | Medium | 5.3 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP re… |
CVE-2023-48245 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP… |
CVE-2022-36352 | Medium | 6.3 | 2024-01-08 | Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profi… |
CVE-2022-34344 | Medium | 5.4 | 2024-01-08 | Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynam… |
CVE-2023-6383 | High | 7.5 | 2024-01-08 | The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log witho… |
CVE-2023-6798 | Medium | 5.4 | 2024-01-06 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings up… |
CVE-2023-6733 | Medium | 6.5 | 2024-01-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem… |
CVE-2024-0201 | Medium | 5.4 | 2024-01-03 | The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_setti… |
CVE-2023-7068 | Medium | 4.3 | 2024-01-03 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a miss… |
CVE-2023-6600 | High | 8.6 | 2024-01-03 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scrip… |
CVE-2023-42358 | High | 7.7 | 2024-01-03 | An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via… |