CWE-862 · Missing Authorization (page 75)
Page 75 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2066 | Medium | 6.3 | 2023-06-09 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabilit… |
CVE-2023-1843 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on t… |
CVE-2023-1375 | Medium | 4.3 | 2023-06-09 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a missing capability chec… |
CVE-2023-1169 | Medium | 4.3 | 2023-06-09 | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback… |
CVE-2023-0993 | Medium | 4.3 | 2023-06-09 | The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.1… |
CVE-2023-0291 | High | 7.2 | 2023-06-09 | The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove… |
CVE-2023-34234 | Medium | 5.3 | 2023-06-07 | OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain t… |
CVE-2021-4379 | Medium | 6.5 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price functio… |
CVE-2021-4337 | High | 8.8 | 2023-06-07 | Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory f… |
CVE-2023-3126 | Medium | 4.3 | 2023-06-07 | The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in v… |
CVE-2023-3125 | Medium | 6.5 | 2023-06-07 | The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' functi… |
CVE-2023-3124 | High | 8.8 | 2023-06-07 | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in… |
CVE-2022-4950 | High | 8.8 | 2023-06-07 | Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by au… |
CVE-2022-4948 | Medium | 4.3 | 2023-06-07 | The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and includi… |
CVE-2021-4383 | High | 8.1 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capabil… |
CVE-2021-4381 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the Stm… |
CVE-2021-4376 | Medium | 4.3 | 2023-06-07 | The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible fo… |
CVE-2021-4375 | Medium | 4.3 | 2023-06-07 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information()… |
CVE-2021-4374 | Critical | 9.1 | 2023-06-07 | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing author… |
CVE-2021-4371 | Medium | 4.3 | 2023-06-07 | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security… |
CVE-2021-4370 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security no… |
CVE-2021-4369 | Medium | 5.8 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lackin… |
CVE-2021-4368 | Critical | 9.9 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking ca… |
CVE-2021-4366 | Medium | 6.3 | 2023-06-07 | The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options func… |
CVE-2021-4364 | Medium | 4.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedul… |
CVE-2021-4362 | Critical | 9.8 | 2023-06-07 | The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() functi… |
CVE-2021-4361 | High | 8.8 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_setti… |
CVE-2021-4359 | Medium | 6.5 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to… |
CVE-2021-4357 | Critical | 9.1 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole… |
CVE-2021-4356 | Critical | 9.0 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due t… |
CVE-2021-4355 | High | 7.5 | 2023-06-07 | The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_o… |
CVE-2021-4351 | Medium | 5.8 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking… |
CVE-2021-4350 | High | 7.2 | 2023-06-07 | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking a… |
CVE-2021-4348 | High | 7.5 | 2023-06-07 | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions i… |
CVE-2021-4347 | Critical | 9.9 | 2023-06-07 | The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenti… |
CVE-2021-4346 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing lo… |
CVE-2021-4345 | Medium | 6.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api metho… |
CVE-2021-4343 | Critical | 9.8 | 2023-06-07 | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is du… |
CVE-2021-4341 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing secu… |
CVE-2021-4339 | High | 7.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/a… |
CVE-2021-4338 | Medium | 6.4 | 2023-06-07 | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in ve… |
CVE-2020-36730 | High | 8.3 | 2023-06-07 | The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable… |
CVE-2020-36729 | Medium | 5.4 | 2023-06-07 | The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via… |
CVE-2020-36725 | High | 8.8 | 2023-06-07 | The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and incl… |
CVE-2020-36721 | Medium | 6.5 | 2023-06-07 | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the… |
CVE-2020-36720 | High | 7.1 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lac… |
CVE-2020-36719 | Critical | 9.8 | 2023-06-07 | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions befo… |
CVE-2020-36716 | High | 7.3 | 2023-06-07 | The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to… |
CVE-2020-36715 | High | 7.4 | 2023-06-07 | The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and… |
CVE-2020-36712 | High | 8.6 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kalifo… |
CVE-2020-36702 | Medium | 5.5 | 2023-06-07 | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to… |
CVE-2020-36699 | Medium | 4.3 | 2023-06-07 | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax a… |
CVE-2020-36697 | High | 7.3 | 2023-06-07 | The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it… |
CVE-2020-36696 | High | 7.5 | 2023-06-07 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads()… |
CVE-2019-25143 | Medium | 5.4 | 2023-06-07 | The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_set… |
CVE-2019-25142 | High | 8.8 | 2023-06-07 | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172… |
CVE-2019-25141 | Critical | 9.8 | 2023-06-07 | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks o… |
CVE-2019-25139 | Medium | 6.5 | 2023-06-07 | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to miss… |
CVE-2023-33477 | Medium | 6.5 | 2023-06-06 | In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path. |
CVE-2023-2183 | Medium | 4.1 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having… |
CVE-2023-30948 | Medium | 6.5 | 2023-06-06 | A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks… |
CVE-2023-30915 | Medium | 5.5 | 2023-06-06 | In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30914 | Medium | 5.5 | 2023-06-06 | In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30866 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30865 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2023-30864 | High | 7.8 | 2023-06-06 | In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-30863 | High | 7.8 | 2023-06-06 | In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48448 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48447 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48446 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48445 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48444 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48443 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48442 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48441 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48440 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48392 | High | 7.8 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48391 | Medium | 5.5 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48390 | High | 7.8 | 2023-06-06 | In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2023-33970 | Medium | 5.4 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, wh… |
CVE-2023-33968 | Medium | 5.4 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vu… |
CVE-2023-2415 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2299 | Medium | 5.3 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wo… |
CVE-2023-3053 | Medium | 5.4 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' funct… |
CVE-2023-28657 | High | 8.8 | 2023-06-01 | Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed ma… |
CVE-2023-2434 | Low | 3.8 | 2023-05-31 | The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, a… |
CVE-2023-2547 | Medium | 5.4 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versio… |
CVE-2023-2545 | High | 8.1 | 2023-05-31 | The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in… |
CVE-2023-24605 | Medium | 4.2 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens. |
CVE-2023-2945 | Medium | 5.4 | 2023-05-27 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-32316 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is du… |
CVE-2023-32311 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not p… |
CVE-2022-39335 | Medium | 5.0 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request… |
CVE-2023-2480 | High | 7.5 | 2023-05-25 | Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applicati… |
CVE-2023-33983 | High | 7.4 | 2023-05-24 | The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-… |
CVE-2023-33948 | Medium | 5.3 | 2023-05-24 | The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from… |
CVE-2023-2494 | Medium | 4.6 | 2023-05-24 | The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2023-27304 | Medium | 4.3 | 2023-05-23 | Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of… |
CVE-2023-31826 | High | 7.8 | 2023-05-23 | Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via sup… |
CVE-2023-33252 | High | 7.5 | 2023-05-21 | iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus. |