CWE-862 · Missing Authorization (page 74)
Page 74 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33884 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33883 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33882 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33881 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33880 | Low | 3.3 | 2023-07-12 | In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-33879 | Low | 3.3 | 2023-07-12 | In music service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-32789 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-32788 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30942 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30941 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30940 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30939 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30938 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30937 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30936 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30935 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30934 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30933 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30932 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30931 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30930 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30929 | High | 7.8 | 2023-07-12 | In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-30928 | High | 7.8 | 2023-07-12 | In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-30927 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30926 | Medium | 5.5 | 2023-07-12 | In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30925 | Medium | 5.5 | 2023-07-12 | In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30924 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30923 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30922 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30921 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30920 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30919 | Medium | 5.5 | 2023-07-12 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30918 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30917 | High | 7.8 | 2023-07-12 | In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-30916 | High | 7.8 | 2023-07-12 | In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-30913 | Medium | 5.5 | 2023-07-12 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-2869 | Medium | 4.3 | 2023-07-12 | The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder f… |
CVE-2023-2562 | Medium | 4.3 | 2023-07-12 | The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up… |
CVE-2023-2561 | Medium | 4.3 | 2023-07-12 | The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versio… |
CVE-2023-33992 | Medium | 4.5 | 2023-07-11 | The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 10… |
CVE-2023-2078 | High | 7.3 | 2023-07-11 | The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on th… |
CVE-2023-3076 | Critical | 9.8 | 2023-07-10 | The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API e… |
CVE-2023-2796 | Medium | 5.3 | 2023-07-10 | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to… |
CVE-2023-20899 | High | 7.5 | 2023-07-06 | VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VM… |
CVE-2023-30195 | High | 7.5 | 2023-07-06 | In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without… |
CVE-2023-35937 | Medium | 6.0 | 2023-07-06 | Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows or… |
CVE-2023-35940 | High | 7.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an u… |
CVE-2023-36624 | High | 7.8 | 2023-07-05 | Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the e… |
CVE-2023-3482 | Medium | 6.5 | 2023-07-05 | When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blan… |
CVE-2023-20773 | High | 7.8 | 2023-07-04 | In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-20772 | Medium | 6.7 | 2023-07-04 | In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional exec… |
CVE-2023-36815 | High | 7.3 | 2023-07-03 | Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billin… |
CVE-2021-4388 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capabil… |
CVE-2023-30586 | High | 7.5 | 2023-07-01 | A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, whi… |
CVE-2023-36144 | High | 7.5 | 2023-06-30 | An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, expos… |
CVE-2023-36607 | Medium | 5.3 | 2023-06-29 | The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as s… |
CVE-2023-21185 | High | 7.8 | 2023-06-28 | In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user wit… |
CVE-2023-21177 | Medium | 5.5 | 2023-06-28 | In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a missing permission ch… |
CVE-2023-21173 | Medium | 5.5 | 2023-06-28 | In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check. This could… |
CVE-2023-21149 | High | 7.8 | 2023-06-28 | In registerGsmaServiceIntentReceiver of ShannonRcsService.java, there is a possible way to activate/deactivate RCS service due to a missing permission check. T… |
CVE-2023-1844 | Medium | 4.3 | 2023-06-28 | The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in v… |
CVE-2023-36002 | Medium | 4.3 | 2023-06-27 | A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network… |
CVE-2023-36000 | Medium | 6.5 | 2023-06-27 | A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent ne… |
CVE-2023-35998 | Medium | 4.6 | 2023-06-27 | A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write u… |
CVE-2023-22834 | Low | 2.7 | 2023-06-27 | The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass fo… |
CVE-2023-35164 | Medium | 6.3 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization… |
CVE-2023-34463 | High | 8.1 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can… |
CVE-2023-36348 | High | 8.8 | 2023-06-23 | POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter. |
CVE-2023-23344 | Low | 3.0 | 2023-06-23 | A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. |
CVE-2023-35093 | Medium | 6.5 | 2023-06-22 | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any l… |
CVE-2023-3315 | Medium | 4.3 | 2023-06-19 | Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attack… |
CVE-2022-48491 | Medium | 5.3 | 2023-06-19 | Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at… |
CVE-2022-46850 | High | 8.6 | 2023-06-19 | Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <= 0.1.3 versions. |
CVE-2023-2791 | Medium | 4.3 | 2023-06-16 | When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel… |
CVE-2023-2788 | Medium | 6.2 | 2023-06-16 | Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent acce… |
CVE-2023-2787 | Medium | 6.5 | 2023-06-16 | Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. |
CVE-2023-2786 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually pos… |
CVE-2023-2784 | Medium | 4.2 | 2023-06-16 | Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests… |
CVE-2023-2783 | Medium | 4.3 | 2023-06-16 | Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent b… |
CVE-2023-34165 | Medium | 5.3 | 2023-06-16 | Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps t… |
CVE-2023-21141 | Medium | 5.5 | 2023-06-15 | In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead to local informatio… |
CVE-2023-21123 | High | 7.8 | 2023-06-15 | In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission… |
CVE-2023-21122 | High | 7.8 | 2023-06-15 | In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission ch… |
CVE-2023-35149 | Medium | 6.5 | 2023-06-14 | A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an… |
CVE-2023-3230 | High | 7.5 | 2023-06-14 | Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
CVE-2023-2351 | Medium | 6.5 | 2023-06-13 | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_ad… |
CVE-2023-2284 | Medium | 4.3 | 2023-06-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db fun… |
CVE-2023-2261 | Medium | 4.3 | 2023-06-09 | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions u… |
CVE-2023-2764 | Medium | 4.3 | 2023-06-09 | The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_set_featured_image fun… |
CVE-2023-2557 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2556 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2555 | Medium | 4.3 | 2023-06-09 | The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2023-2414 | Medium | 5.4 | 2023-06-09 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2280 | Medium | 6.5 | 2023-06-09 | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_pu… |
CVE-2023-2275 | Medium | 4.3 | 2023-06-09 | The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capa… |
CVE-2023-2189 | Medium | 4.3 | 2023-06-09 | The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2023-2086 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the template_count function i… |
CVE-2023-2085 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templates function in ver… |
CVE-2023-2084 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions… |
CVE-2023-2083 | Medium | 4.3 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions… |