CWE-862 · Missing Authorization (page 70)
Page 70 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38179 | High | 8.8 | 2024-10-08 | Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability |
CVE-2024-8431 | Medium | 4.3 | 2024-10-08 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-9161 | Medium | 6.5 | 2024-10-05 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing cap… |
CVE-2024-47768 | High | 8.1 | 2024-10-04 | Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system whe… |
CVE-2024-47790 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of insecure Real-Time Streaming Protocol (RTSP) version… | |
CVE-2024-20477 | Medium | 5.4 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an aff… |
CVE-2024-20442 | Medium | 5.4 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrat… |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-8430 | Medium | 5.3 | 2024-10-01 | The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_im… |
CVE-2024-8675 | Medium | 4.3 | 2024-10-01 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway… |
CVE-2024-8632 | Medium | 6.5 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing cap… |
CVE-2024-8548 | High | 8.1 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capab… |
CVE-2024-9297 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-9189 | Medium | 5.3 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_e… |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-8771 | Medium | 4.3 | 2024-09-26 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-9025 | Medium | 5.3 | 2024-09-26 | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2024-47337 | Medium | 4.3 | 2024-09-26 | Missing Authorization vulnerability in Phillip Dane Joy Of Text Lite joy-of-text.This issue affects Joy Of Text Lite: from n/a through <= 2.3.1. |
CVE-2024-8552 | Medium | 4.3 | 2024-09-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in… |
CVE-2024-47330 | Medium | 4.3 | 2024-09-26 | Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.This issue affects Slider by Supsystic: from… |
CVE-2024-8678 | Medium | 5.3 | 2024-09-25 | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/rev… |
CVE-2024-8658 | Medium | 5.3 | 2024-09-25 | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi… |
CVE-2024-6845 | Medium | 5.3 | 2024-09-25 | The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrie… |
CVE-2024-8434 | Medium | 4.3 | 2024-09-25 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several func… |
CVE-2024-8350 | Low | 2.7 | 2024-09-25 | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_… |
CVE-2024-8349 | High | 7.2 | 2024-09-25 | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the p… |
CVE-2024-7491 | Medium | 5.3 | 2024-09-25 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2024-6590 | Medium | 6.3 | 2024-09-25 | The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for… |
CVE-2024-8437 | Medium | 4.3 | 2024-09-25 | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions… |
CVE-2024-8432 | Medium | 4.3 | 2024-09-24 | The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2022-25768 | High | 7.0 | 2024-09-18 | The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to t… |
CVE-2024-6406 | | 2024-09-18 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve E… | |
CVE-2024-40852 | Medium | 5.3 | 2024-09-17 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent… |
CVE-2024-7888 | Medium | 6.3 | 2024-09-13 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-4660 | Medium | 6.5 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions… |
CVE-2024-3305 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. … |
CVE-2024-7727 | Medium | 5.3 | 2024-09-11 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2024-7721 | Medium | 4.3 | 2024-09-11 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-40652 | High | 7.8 | 2024-09-11 | In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission c… |
CVE-2024-40650 | High | 7.8 | 2024-09-11 | In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege w… |
CVE-2024-45591 | Medium | 5.3 | 2024-09-10 | XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information… |
CVE-2024-45393 | Medium | 6.4 | 2024-09-10 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhoo… |
CVE-2024-8369 | Medium | 5.3 | 2024-09-10 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to… |
CVE-2024-45285 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a c… |
CVE-2024-45284 | Low | 2.4 | 2024-09-10 | An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of… |
CVE-2024-44117 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook… |
CVE-2024-45286 | Medium | 6.5 | 2024-09-10 | Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows una… |
CVE-2024-44112 | Medium | 4.3 | 2024-09-10 | Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a… |
CVE-2024-41728 | Low | 2.7 | 2024-09-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects con… |
CVE-2024-44116 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to id… |
CVE-2024-44115 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify u… |
CVE-2024-44113 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is oth… |
CVE-2024-42380 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nod… |
CVE-2024-42371 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify u… |
CVE-2024-41729 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On… |
CVE-2024-8042 | Low | 2.4 | 2024-09-09 | Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local req… |
CVE-2024-40709 | High | 7.8 | 2024-09-07 | A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. |
CVE-2023-39298 | High | 7.8 | 2024-09-06 | A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local aut… |
CVE-2024-44408 | High | 7.5 | 2024-09-06 | D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded con… |
CVE-2024-7622 | Medium | 4.3 | 2024-09-06 | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailT… |
CVE-2024-1744 | High | 7.5 | 2024-09-06 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. Th… |
CVE-2024-8427 | Medium | 4.3 | 2024-09-06 | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2024-8480 | High | 8.8 | 2024-09-06 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 's… |
CVE-2024-44082 | Medium | 4.3 | 2024-09-06 | In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used b… |
CVE-2024-7605 | Medium | 4.3 | 2024-09-05 | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versio… |
CVE-2024-7381 | Medium | 5.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__short… |
CVE-2024-7380 | Medium | 4.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and a… |
CVE-2024-6332 | Medium | 6.5 | 2024-09-05 | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing… |
CVE-2024-5309 | Medium | 5.4 | 2024-09-05 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capabil… |
CVE-2024-45050 | High | 7.1 | 2024-09-04 | Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server do… |
CVE-2024-8289 | Critical | 9.8 | 2024-09-04 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and accou… |
CVE-2024-8121 | Medium | 5.4 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability chec… |
CVE-2024-8102 | High | 8.8 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2024-7950 | Critical | 9.8 | 2024-09-04 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settin… |
CVE-2024-45307 | High | 8.8 | 2024-09-03 | SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretica… |
CVE-2024-4259 | Critical | 9.8 | 2024-09-03 | Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by U… |
CVE-2024-5053 | Medium | 4.2 | 2024-09-01 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key… |
CVE-2024-7858 | Medium | 6.3 | 2024-08-30 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-lib… |
CVE-2024-5784 | High | 7.1 | 2024-08-30 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions… |
CVE-2024-43940 | Medium | 6.5 | 2024-08-29 | Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N… |
CVE-2024-43939 | Medium | 6.5 | 2024-08-29 | Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N… |
CVE-2024-7856 | High | 8.1 | 2024-08-29 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missi… |
CVE-2024-5987 | Medium | 5.4 | 2024-08-29 | The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contra… |
CVE-2024-5857 | Medium | 5.3 | 2024-08-29 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of… |
CVE-2024-4428 | Critical | 9.8 | 2024-08-29 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as P… |
CVE-2024-41918 | Medium | 6.1 | 2024-08-29 | 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for… |
CVE-2024-45058 | High | 8.1 | 2024-08-28 | i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 b… |
CVE-2024-20413 | Medium | 6.7 | 2024-08-28 | A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-… |
CVE-2024-8195 | Medium | 5.3 | 2024-08-28 | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_quer… |
CVE-2024-7447 | Medium | 5.3 | 2024-08-28 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modifica… |
CVE-2024-8199 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-6688 | Medium | 4.3 | 2024-08-27 | The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJA… |
CVE-2024-43214 | Medium | 5.3 | 2024-08-26 | Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2. |
CVE-2024-6631 | Medium | 5.0 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several A… |
CVE-2024-7258 | High | 8.8 | 2024-08-23 | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedF… |
CVE-2024-43331 | Medium | 5.3 | 2024-08-22 | Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. |
CVE-2024-45168 | Critical | 9.1 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, co… |
CVE-2024-7390 | Medium | 5.3 | 2024-08-21 | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrd… |
CVE-2024-7032 | Medium | 6.5 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndCl… |
CVE-2024-7030 | Medium | 4.3 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several function… |