CWE-862 · Missing Authorization (page 77)
Page 77 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47479 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47478 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47477 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47476 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47475 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47474 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47473 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47472 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47471 | Medium | 5.5 | 2023-03-10 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47462 | Medium | 6.7 | 2023-03-10 | In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2022-47461 | Medium | 6.7 | 2023-03-10 | In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2023-1339 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update… |
CVE-2023-1338 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_ru… |
CVE-2023-1337 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs f… |
CVE-2023-1336 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactiv… |
CVE-2023-1335 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_… |
CVE-2023-1334 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_pos… |
CVE-2023-1333 | Medium | 4.3 | 2023-03-10 | The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cach… |
CVE-2023-20064 | Medium | 4.6 | 2023-03-09 | A vulnerability in the GRand Unified Bootloader (GRUB) for Cisco IOS XR Software could allow an unauthenticated attacker with physical access to the device to… |
CVE-2023-26957 | Critical | 9.1 | 2023-03-09 | onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins. |
CVE-2023-25573 | High | 8.6 | 2023-03-09 | metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`… |
CVE-2020-36670 | Medium | 6.3 | 2023-03-07 | The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing cap… |
CVE-2022-4932 | Medium | 4.3 | 2023-03-07 | The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on… |
CVE-2021-4331 | High | 8.8 | 2023-03-07 | The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plu… |
CVE-2020-36667 | Medium | 5.4 | 2023-03-07 | The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1… |
CVE-2023-22858 | Medium | 5.3 | 2023-03-06 | An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs. |
CVE-2023-26510 | Medium | 5.7 | 2023-03-05 | Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a co… |
CVE-2023-1114 | Critical | 9.8 | 2023-03-01 | Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before 1.0.0.100. |
CVE-2023-1027 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap functi… |
CVE-2023-1026 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versio… |
CVE-2023-1024 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in v… |
CVE-2023-1023 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function… |
CVE-2023-1022 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in ve… |
CVE-2023-27264 | High | 7.1 | 2023-02-27 | A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbook… |
CVE-2023-27263 | Medium | 4.3 | 2023-02-27 | A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are… |
CVE-2023-26035 | High | 7.2 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2022-4385 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in use… |
CVE-2022-48318 | Medium | 5.3 | 2023-02-20 | No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information discl… |
CVE-2023-23850 | Medium | 4.3 | 2023-02-15 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-23848 | Medium | 4.3 | 2023-02-15 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-25768 | Medium | 6.5 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2023-25766 | Medium | 4.3 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2023-24528 | Medium | 6.5 | 2023-02-14 | SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured applic… |
CVE-2023-24524 | Medium | 6.5 | 2023-02-14 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privi… |
CVE-2023-23854 | Low | 3.8 | 2023-02-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks… |
CVE-2023-0019 | Medium | 6.5 | 2023-02-14 | In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module… |
CVE-2022-47450 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47367 | Medium | 5.5 | 2023-02-12 | In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47361 | High | 7.8 | 2023-02-12 | In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2022-47360 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47359 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47358 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47357 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47341 | Medium | 6.7 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2022-47339 | Medium | 6.7 | 2023-02-12 | In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution… |
CVE-2022-47333 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47332 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47330 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47329 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47328 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47327 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47326 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47325 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47324 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-44421 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure. |
CVE-2023-21450 | Low | 2.3 | 2023-02-09 | Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's widget without authorization via g… |
CVE-2022-48302 | High | 7.5 | 2023-02-09 | The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2023-0720 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versi… |
CVE-2023-0717 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions… |
CVE-2023-0716 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up… |
CVE-2023-0715 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions u… |
CVE-2023-0711 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up… |
CVE-2023-0684 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versio… |
CVE-2023-0718 | Medium | 5.4 | 2023-02-08 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up… |
CVE-2023-0719 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in version… |
CVE-2023-0712 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up… |
CVE-2023-0713 | Medium | 5.4 | 2023-02-07 | The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up… |
CVE-2022-21953 | High | 7.4 | 2023-02-07 | A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster… |
CVE-2022-48166 | High | 7.5 | 2023-02-06 | An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain adm… |
CVE-2021-31577 | Critical | 9.8 | 2023-02-06 | In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attack… |
CVE-2021-31576 | High | 7.5 | 2023-02-06 | In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker w… |
CVE-2021-36225 | High | 8.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installa… |
CVE-2023-0678 | Medium | 5.3 | 2023-02-04 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2022-42909 | Medium | 6.5 | 2023-02-03 | WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow… |
CVE-2023-25014 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-0619 | Medium | 6.5 | 2023-02-01 | The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up t… |
CVE-2022-4872 | Medium | 4.3 | 2023-01-30 | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belon… |
CVE-2023-22737 | Medium | 6.5 | 2023-01-28 | wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation c… |
CVE-2023-0556 | Critical | 9.8 | 2023-01-27 | The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and incl… |
CVE-2022-39811 | Critical | 9.1 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying pe… |
CVE-2023-0555 | High | 8.1 | 2023-01-27 | The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, a… |
CVE-2023-24459 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-24453 | Medium | 6.5 | 2023-01-26 | A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2023-24451 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2023-24448 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24438 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2023-24436 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-24435 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-24433 | Medium | 6.5 | 2023-01-26 | Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24431 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |