CWE-862 · Missing Authorization (page 71)
Page 71 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49620 | Medium | 6.5 | 2023-11-30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unaut… |
CVE-2023-49674 | Medium | 4.3 | 2023-11-29 | A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2023-49654 | Critical | 9.8 | 2023-11-29 | Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system. |
CVE-2023-49652 | Low | 2.7 | 2023-11-29 | Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (w… |
CVE-2023-5737 | Medium | 4.3 | 2023-11-27 | The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update… |
CVE-2023-5611 | Medium | 5.3 | 2023-11-27 | The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing una… |
CVE-2023-5525 | Medium | 4.3 | 2023-11-27 | The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a va… |
CVE-2023-30581 | High | 7.5 | 2023-11-23 | The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This… |
CVE-2023-6007 | High | 7.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple… |
CVE-2023-5419 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail functi… |
CVE-2023-5417 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category func… |
CVE-2023-5416 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category func… |
CVE-2023-5415 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category functio… |
CVE-2023-5411 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post functi… |
CVE-2023-5387 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mod… |
CVE-2023-5386 | Medium | 6.5 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts functio… |
CVE-2023-5385 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function… |
CVE-2023-5314 | Medium | 4.3 | 2023-11-22 | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' sectio… |
CVE-2023-4686 | Medium | 4.3 | 2023-11-22 | The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts… |
CVE-2023-2448 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in… |
CVE-2023-47757 | Medium | 4.3 | 2023-11-17 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation… |
CVE-2023-39544 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-48222 | High | 8.1 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-47112 | Medium | 4.3 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-6020 | High | 7.5 | 2023-11-16 | LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. |
CVE-2023-6038 | High | 7.5 | 2023-11-16 | A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with t… |
CVE-2023-4723 | Medium | 5.3 | 2023-11-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_pos… |
CVE-2023-6001 | Medium | 5.3 | 2023-11-08 | Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. |
CVE-2023-5506 | Medium | 5.4 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in… |
CVE-2023-43885 | High | 8.1 | 2023-11-07 | Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device. |
CVE-2023-5454 | High | 7.5 | 2023-11-06 | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete a… |
CVE-2023-4700 | Low | 3.5 | 2023-11-06 | An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to… |
CVE-2023-36621 | Critical | 9.1 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions tempora… |
CVE-2023-46352 | High | 7.5 | 2023-11-02 | In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for Prest… |
CVE-2023-43194 | Medium | 5.3 | 2023-11-02 | Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter. |
CVE-2023-42655 | Medium | 6.7 | 2023-11-01 | In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of p… |
CVE-2023-42654 | Medium | 5.5 | 2023-11-01 | In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42652 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42651 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42650 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42648 | Medium | 5.5 | 2023-11-01 | In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42646 | Medium | 5.5 | 2023-11-01 | In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42644 | Medium | 5.5 | 2023-11-01 | In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42643 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42642 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42641 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42640 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42639 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42638 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42637 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42636 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42635 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42634 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42633 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42632 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-42631 | Medium | 5.5 | 2023-11-01 | In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-4198 | Medium | 6.5 | 2023-11-01 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
CVE-2022-3007 | High | 8.1 | 2023-10-31 | The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used… |
CVE-2023-5862 | Low | 3.3 | 2023-10-31 | Missing Authorization in GitHub repository hamza417/inure prior to Build95. |
CVE-2023-21393 | High | 7.8 | 2023-10-30 | In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no add… |
CVE-2023-21389 | High | 7.8 | 2023-10-30 | In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2023-21388 | High | 7.8 | 2023-10-30 | In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-21382 | Medium | 5.5 | 2023-10-30 | In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could… |
CVE-2023-21378 | High | 7.8 | 2023-10-30 | In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of… |
CVE-2023-21373 | High | 7.8 | 2023-10-30 | In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of pr… |
CVE-2023-21341 | High | 7.8 | 2023-10-30 | In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privile… |
CVE-2023-21340 | Medium | 5.5 | 2023-10-30 | In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additiona… |
CVE-2023-21329 | Medium | 5.5 | 2023-10-30 | In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information d… |
CVE-2023-21328 | High | 7.8 | 2023-10-30 | In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This coul… |
CVE-2023-21321 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2023-21313 | High | 7.8 | 2023-10-30 | In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege wi… |
CVE-2023-21294 | Medium | 5.5 | 2023-10-30 | In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2021-39810 | High | 7.8 | 2023-10-30 | In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent du… |
CVE-2023-5251 | Medium | 5.4 | 2023-10-30 | The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save… |
CVE-2023-5426 | High | 7.5 | 2023-10-28 | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user… |
CVE-2023-5425 | High | 8.8 | 2023-10-28 | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user… |
CVE-2023-30969 | High | 8.2 | 2023-10-26 | The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpo… |
CVE-2023-5311 | High | 8.8 | 2023-10-25 | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions u… |
CVE-2023-4606 | High | 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3… |
CVE-2023-46652 | Medium | 4.3 | 2023-10-25 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-43488 | High | 7.9 | 2023-10-25 | The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Andr… |
CVE-2023-37910 | High | 8.1 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move supp… |
CVE-2023-5132 | High | 7.5 | 2023-10-21 | The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest funct… |
CVE-2023-5533 | Medium | 5.3 | 2023-10-20 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versio… |
CVE-2023-4941 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-4668 | Medium | 5.3 | 2023-10-20 | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL param… |
CVE-2023-3998 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions… |
CVE-2023-3869 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in vers… |
CVE-2022-4943 | High | 7.5 | 2023-10-20 | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin setting… |
CVE-2022-3622 | Medium | 4.1 | 2023-10-20 | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This mak… |
CVE-2023-4947 | Medium | 4.3 | 2023-10-20 | The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_or… |
CVE-2023-4943 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2021-4353 | Medium | 5.3 | 2023-10-20 | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. Th… |
CVE-2020-36698 | High | 8.8 | 2023-10-20 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is du… |
CVE-2023-27792 | High | 7.8 | 2023-10-19 | An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories. |
CVE-2023-4645 | Medium | 5.3 | 2023-10-19 | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow… |
CVE-2023-4938 | Medium | 4.3 | 2023-10-18 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-44689 | Medium | 4.3 | 2023-10-11 | e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to i… |
CVE-2023-42473 | Medium | 5.4 | 2023-10-10 | S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of pri… |
CVE-2022-36228 | Medium | 6.5 | 2023-10-09 | Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the… |