CWE-862 · Missing Authorization (page 73)
Page 73 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38442 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38441 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38440 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38439 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38438 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38437 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38436 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33918 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33917 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33916 | Medium | 5.5 | 2023-09-04 | In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33915 | High | 7.5 | 2023-09-04 | In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed |
CVE-2022-48452 | Medium | 4.4 | 2023-09-04 | In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed |
CVE-2023-41046 | Medium | 6.3 | 2023-09-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code witho… |
CVE-2023-23763 | Medium | 5.3 | 2023-09-01 | An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upst… |
CVE-2023-24674 | High | 7.8 | 2023-09-01 | Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter. |
CVE-2023-41750 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047. |
CVE-2023-4245 | Medium | 4.3 | 2023-08-31 | The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail functi… |
CVE-2023-3999 | Medium | 6.3 | 2023-08-31 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up… |
CVE-2023-2353 | Medium | 4.3 | 2023-08-31 | The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd… |
CVE-2023-2174 | Medium | 4.3 | 2023-08-31 | The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries functio… |
CVE-2023-40530 | Medium | 4.7 | 2023-08-25 | Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier all… |
CVE-2023-38508 | Medium | 6.5 | 2023-08-24 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and T… |
CVE-2020-23793 | High | 8.6 | 2023-08-22 | An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvi… |
CVE-2023-4302 | Medium | 4.2 | 2023-08-21 | A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-4434 | Medium | 6.1 | 2023-08-20 | Missing Authorization in GitHub repository hamza417/inure prior to build88. |
CVE-2023-3244 | Medium | 4.3 | 2023-08-17 | The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings fun… |
CVE-2023-40344 | Medium | 4.3 | 2023-08-16 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2023-39507 | Medium | 6.1 | 2023-08-16 | Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerabl… |
CVE-2023-4374 | Medium | 4.3 | 2023-08-16 | The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refre… |
CVE-2023-40027 | Low | 3.7 | 2023-08-15 | Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL qu… |
CVE-2023-39438 | High | 8.1 | 2023-08-15 | A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific addit… |
CVE-2023-21288 | Medium | 5.5 | 2023-08-14 | In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local informatio… |
CVE-2023-21234 | Medium | 5.5 | 2023-08-14 | In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing… |
CVE-2023-21140 | Medium | 6.8 | 2023-08-14 | In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead t… |
CVE-2023-21134 | Medium | 6.8 | 2023-08-14 | In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead t… |
CVE-2023-21133 | Medium | 6.8 | 2023-08-14 | In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead t… |
CVE-2023-21132 | Medium | 6.8 | 2023-08-14 | In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead t… |
CVE-2023-4106 | Medium | 6.3 | 2023-08-11 | Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join… |
CVE-2023-4105 | Low | 3.1 | 2023-08-11 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of… |
CVE-2023-39966 | High | 7.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct… |
CVE-2023-40216 | Medium | 5.5 | 2023-08-10 | OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel cr… |
CVE-2023-4282 | Medium | 5.4 | 2023-08-10 | The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private… |
CVE-2023-37862 | High | 8.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This… |
CVE-2023-37860 | High | 7.5 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 d… |
CVE-2023-37492 | Medium | 4.9 | 2023-08-08 | SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SA… |
CVE-2023-33912 | Medium | 5.5 | 2023-08-07 | In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33911 | Medium | 5.5 | 2023-08-07 | In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33910 | Medium | 5.5 | 2023-08-07 | In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33909 | Medium | 5.5 | 2023-08-07 | In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33908 | Medium | 5.5 | 2023-08-07 | In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33907 | Medium | 5.5 | 2023-08-07 | In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-33906 | Medium | 5.5 | 2023-08-07 | In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges |
CVE-2023-38494 | Medium | 5.9 | 2023-08-04 | MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configu… |
CVE-2023-30950 | Medium | 6.5 | 2023-08-03 | The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint |
CVE-2023-4124 | Medium | 6.5 | 2023-08-03 | Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1. |
CVE-2023-3426 | Medium | 4.3 | 2023-08-02 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows re… |
CVE-2023-38989 | Medium | 4.3 | 2023-07-31 | An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role inf… |
CVE-2023-0958 | Medium | 4.3 | 2023-07-28 | Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation fun… |
CVE-2023-38510 | High | 8.1 | 2023-07-27 | Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fa… |
CVE-2023-3956 | Critical | 9.8 | 2023-07-27 | The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check… |
CVE-2023-3442 | High | 7.7 | 2023-07-26 | A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could ca… |
CVE-2022-43712 | Medium | 6.5 | 2023-07-26 | POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user i… |
CVE-2023-37049 | Medium | 6.5 | 2023-07-26 | emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php. |
CVE-2023-26301 | Critical | 9.8 | 2023-07-21 | Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authenticatio… |
CVE-2023-3300 | Medium | 5.3 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users w… |
CVE-2023-3072 | Medium | 4.1 | 2023-07-20 | HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5… |
CVE-2023-33265 | High | 8.8 | 2023-07-18 | In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users t… |
CVE-2023-3714 | High | 7.5 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versio… |
CVE-2023-3713 | High | 8.8 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_conn… |
CVE-2023-3403 | Medium | 5.4 | 2023-07-18 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in ve… |
CVE-2023-3587 | Low | 2.7 | 2023-07-17 | Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join th… |
CVE-2023-2268 | High | 7.1 | 2023-07-15 | Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. |
CVE-2023-21257 | High | 7.8 | 2023-07-13 | In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. Thi… |
CVE-2023-21248 | High | 7.8 | 2023-07-13 | In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing per… |
CVE-2023-21247 | High | 7.8 | 2023-07-13 | In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missin… |
CVE-2023-37965 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2023-37963 | Medium | 5.4 | 2023-07-12 | A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37959 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37956 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2023-37953 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usin… |
CVE-2023-37950 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials… |
CVE-2023-37949 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2023-37945 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to dow… |
CVE-2023-37944 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL us… |
CVE-2023-33902 | Medium | 5.5 | 2023-07-12 | In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33901 | Medium | 5.5 | 2023-07-12 | In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33900 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33899 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33898 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33895 | Medium | 5.5 | 2023-07-12 | In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33894 | Medium | 5.5 | 2023-07-12 | In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33893 | Medium | 5.5 | 2023-07-12 | In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33892 | Medium | 5.5 | 2023-07-12 | In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33891 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33890 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33889 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33888 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33887 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33886 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33885 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |