CWE-862 · Missing Authorization (page 76)
Page 76 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2716 | Medium | 5.4 | 2023-05-20 | The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload… |
CVE-2023-2715 | Medium | 4.3 | 2023-05-20 | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in ver… |
CVE-2023-2714 | Medium | 4.3 | 2023-05-20 | The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in ve… |
CVE-2023-28623 | Medium | 6.5 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication b… |
CVE-2023-32677 | Low | 3.1 | 2023-05-19 | Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to strea… |
CVE-2023-2757 | High | 7.4 | 2023-05-18 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versi… |
CVE-2023-20726 | Low | 3.3 | 2023-05-15 | In mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with no additional executi… |
CVE-2023-2590 | Low | 3.5 | 2023-05-09 | Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9. |
CVE-2023-32112 | Low | 2.8 | 2023-05-09 | Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617… |
CVE-2022-48388 | High | 7.8 | 2023-05-09 | In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48384 | High | 7.8 | 2023-05-09 | In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48383 | High | 7.8 | 2023-05-09 | .In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48379 | Medium | 5.5 | 2023-05-09 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48378 | Medium | 5.5 | 2023-05-09 | In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48377 | Medium | 5.5 | 2023-05-09 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48376 | Medium | 5.5 | 2023-05-09 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48375 | Medium | 5.5 | 2023-05-09 | In contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48371 | Medium | 5.5 | 2023-05-09 | In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges. |
CVE-2022-48370 | Medium | 5.5 | 2023-05-09 | In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges. |
CVE-2022-48369 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48368 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48250 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48249 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48248 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48247 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48246 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48245 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48244 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48243 | High | 7.8 | 2023-05-09 | In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-48242 | Medium | 5.5 | 2023-05-09 | In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges. |
CVE-2022-47493 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47492 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-47490 | Medium | 5.5 | 2023-05-09 | In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-44433 | High | 7.8 | 2023-05-09 | In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. |
CVE-2022-38685 | Medium | 5.5 | 2023-05-09 | In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional executio… |
CVE-2023-22813 | Low | 3.3 | 2023-05-08 | A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile A… |
CVE-2023-27963 | High | 7.5 | 2023-05-08 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4… |
CVE-2023-31047 | Critical | 9.8 | 2023-05-07 | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. T… |
CVE-2023-0805 | Medium | 4.9 | 2023-05-03 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all version… |
CVE-2023-22728 | Medium | 4.3 | 2023-04-26 | Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField p… |
CVE-2023-1414 | Medium | 4.3 | 2023-04-24 | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated us… |
CVE-2023-2193 | Medium | 6.5 | 2023-04-20 | Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate… |
CVE-2023-21094 | High | 7.8 | 2023-04-19 | In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permission check. This cou… |
CVE-2023-21091 | Medium | 5.5 | 2023-04-19 | In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission check. This could lead t… |
CVE-2023-20909 | Medium | 5.5 | 2023-04-19 | In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. This could lead to local information dis… |
CVE-2023-25552 | High | 8.1 | 2023-04-18 | A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauth… |
CVE-2023-1371 | Medium | 6.5 | 2023-04-17 | The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow… |
CVE-2023-29529 | Medium | 5.0 | 2023-04-14 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eave… |
CVE-2023-30532 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to… |
CVE-2023-30526 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2023-30522 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jo… |
CVE-2023-30521 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corre… |
CVE-2023-30519 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the at… |
CVE-2023-30518 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2020-9009 | Low | 3.7 | 2023-04-11 | The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) becaus… |
CVE-2023-1903 | Medium | 4.3 | 2023-04-11 | SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header… |
CVE-2023-1931 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCacheToolbar function… |
CVE-2023-1930 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_cache_of_allsites_cal… |
CVE-2023-1929 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purgecache_varnish_call… |
CVE-2023-1928 | Medium | 4.3 | 2023-04-06 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_preload_single_callback… |
CVE-2023-1167 | Medium | 5.3 | 2023-04-05 | Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from… |
CVE-2023-1782 | Critical | 9.9 | 2023-04-05 | HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is no… |
CVE-2022-4940 | High | 7.3 | 2023-04-05 | The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing… |
CVE-2022-4939 | Critical | 9.8 | 2023-04-05 | THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on th… |
CVE-2022-4937 | Medium | 6.3 | 2023-04-05 | The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to mis… |
CVE-2022-4935 | High | 8.8 | 2023-04-05 | The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing… |
CVE-2023-1868 | Medium | 6.5 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_cl… |
CVE-2023-1865 | Medium | 6.5 | 2023-04-05 | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_n… |
CVE-2023-26269 | High | 7.8 | 2023-04-03 | Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malic… |
CVE-2023-28675 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf ser… |
CVE-2023-28673 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-28672 | Medium | 6.5 | 2023-04-02 | Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with O… |
CVE-2023-1774 | Medium | 4.2 | 2023-03-31 | When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to… |
CVE-2023-27701 | High | 8.1 | 2023-03-28 | MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html. |
CVE-2022-48350 | High | 7.5 | 2023-03-27 | The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-28640 | Medium | 6.4 | 2023-03-27 | Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may… |
CVE-2023-0336 | Medium | 6.5 | 2023-03-27 | The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscr… |
CVE-2023-0335 | Medium | 6.5 | 2023-03-27 | The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachme… |
CVE-2023-21029 | Medium | 5.5 | 2023-03-24 | In register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usage with User executio… |
CVE-2023-21021 | High | 7.8 | 2023-03-24 | In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settings due to a missing… |
CVE-2023-21015 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead… |
CVE-2023-21005 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead… |
CVE-2023-21004 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead… |
CVE-2023-21003 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead… |
CVE-2023-21002 | High | 7.8 | 2023-03-24 | In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead… |
CVE-2023-21001 | High | 7.8 | 2023-03-24 | In onContextItemSelected of NetworkProviderSettings.java, there is a possible way for users to change the Wi-Fi settings of other users due to a missing permis… |
CVE-2023-20959 | High | 7.8 | 2023-03-24 | In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead to local escalation o… |
CVE-2023-20955 | High | 7.8 | 2023-03-24 | In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications for all users due to… |
CVE-2023-20926 | Medium | 6.8 | 2023-03-24 | In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permission check. This coul… |
CVE-2023-1262 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. |
CVE-2023-1261 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. |
CVE-2022-45636 | High | 8.1 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API req… |
CVE-2023-0911 | Medium | 6.5 | 2023-03-20 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, al… |
CVE-2023-0890 | Medium | 6.5 | 2023-03-20 | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already… |
CVE-2022-4148 | Medium | 4.3 | 2023-03-20 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow an… |
CVE-2023-1299 | High | 7.4 | 2023-03-14 | HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5… |
CVE-2023-1296 | Low | 2.7 | 2023-03-14 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1. |
CVE-2023-27462 | Low | 3.1 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper… |
CVE-2023-27310 | Medium | 6.6 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper… |
CVE-2023-27309 | Medium | 5.0 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper… |