CWE-862 · Missing Authorization (page 78)
Page 78 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-23611 | Medium | 5.4 | 2023-01-26 | LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, pri… |
CVE-2023-22736 | High | 8.5 | 2023-01-26 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, ar… |
CVE-2023-20916 | High | 7.8 | 2023-01-26 | In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due t… |
CVE-2023-20912 | High | 7.8 | 2023-01-26 | In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This cou… |
CVE-2022-3482 | Medium | 5.3 | 2023-01-26 | An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an un… |
CVE-2023-0447 | Medium | 4.3 | 2023-01-23 | The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions… |
CVE-2023-0404 | Medium | 5.4 | 2023-01-19 | The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions… |
CVE-2023-0402 | Medium | 5.4 | 2023-01-19 | The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and… |
CVE-2023-0242 | High | 8.8 | 2023-01-18 | Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server i… |
CVE-2022-41417 | Critical | 9.8 | 2023-01-18 | BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/. |
CVE-2020-22007 | Medium | 6.8 | 2023-01-18 | OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands wi… |
CVE-2018-14628 | Medium | 4.3 | 2023-01-17 | An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could… |
CVE-2023-22478 | High | 7.3 | 2023-01-14 | KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1… |
CVE-2023-0293 | Medium | 4.3 | 2023-01-13 | The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in vers… |
CVE-2023-22489 | Low | 3.5 | 2023-01-13 | Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view… |
CVE-2023-22488 | Medium | 6.8 | 2023-01-12 | Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that wou… |
CVE-2022-4103 | Medium | 4.3 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the po… |
CVE-2022-4102 | Low | 3.1 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the pos… |
CVE-2022-3923 | Medium | 4.3 | 2023-01-09 | The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which co… |
CVE-2022-44439 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44438 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44437 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44436 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44435 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44434 | Medium | 5.5 | 2023-01-04 | In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileg… |
CVE-2022-44424 | Medium | 5.5 | 2023-01-04 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges n… |
CVE-2022-44423 | Medium | 5.5 | 2023-01-04 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges n… |
CVE-2022-44422 | Medium | 5.5 | 2023-01-04 | In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges n… |
CVE-2022-39104 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with no additional execution privilege… |
CVE-2022-39088 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39087 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39086 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39085 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39084 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39083 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39082 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39081 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-38684 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38683 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38682 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38678 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-3911 | High | 8.8 | 2023-01-02 | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belon… |
CVE-2021-45467 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an ar… |
CVE-2022-45410 | Medium | 6.5 | 2022-12-22 | When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This… |
CVE-2022-4124 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to d… |
CVE-2022-4024 | Medium | 6.5 | 2022-12-19 | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenti… |
CVE-2022-3961 | Medium | 6.5 | 2022-12-19 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. |
CVE-2022-26581 | Medium | 6.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specifi… |
CVE-2022-20572 | Medium | 6.7 | 2022-12-16 | In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalatio… |
CVE-2022-20556 | Low | 3.3 | 2022-12-16 | In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a new WiFi network due to a missing permis… |
CVE-2022-20547 | High | 7.8 | 2022-12-16 | In multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing permission check. This could lead to local… |
CVE-2022-20544 | Medium | 4.4 | 2022-12-16 | In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lea… |
CVE-2022-20537 | Low | 3.3 | 2022-12-16 | In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check… |
CVE-2022-20536 | Low | 3.3 | 2022-12-16 | In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. This could lead to loc… |
CVE-2022-20533 | Low | 3.3 | 2022-12-16 | In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. This could lead to… |
CVE-2022-20529 | Low | 2.4 | 2022-12-16 | In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This could lead to local esca… |
CVE-2022-20522 | High | 7.8 | 2022-12-16 | In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no addit… |
CVE-2022-20519 | Low | 3.3 | 2022-12-16 | In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission check. This could l… |
CVE-2022-20511 | Medium | 5.5 | 2022-12-16 | In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead to local information disclosure with no… |
CVE-2022-20510 | Medium | 5.5 | 2022-12-16 | In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other u… |
CVE-2022-20508 | High | 7.8 | 2022-12-16 | In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to loc… |
CVE-2022-20506 | High | 7.8 | 2022-12-16 | In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additio… |
CVE-2022-20504 | Medium | 6.7 | 2022-12-16 | In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and dismissal of syste… |
CVE-2022-20503 | High | 7.8 | 2022-12-16 | In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This c… |
CVE-2022-4555 | Medium | 6.5 | 2022-12-16 | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in ve… |
CVE-2022-4501 | High | 7.1 | 2022-12-14 | The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to… |
CVE-2022-4223 | High | 8.8 | 2022-12-13 | The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg… |
CVE-2022-20240 | Low | 2.3 | 2022-12-13 | In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead t… |
CVE-2022-41272 | Critical | 9.9 | 2022-12-13 | An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Int… |
CVE-2022-41271 | Critical | 9.4 | 2022-12-13 | An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50… |
CVE-2022-3999 | High | 8.1 | 2022-12-12 | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such… |
CVE-2022-3946 | Medium | 6.5 | 2022-12-12 | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and… |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-4366 | High | 7.5 | 2022-12-08 | Missing Authorization in GitHub repository lirantal/daloradius prior to master branch. |
CVE-2022-43581 | High | 7.5 | 2022-12-07 | IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization a… |
CVE-2022-42782 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42778 | High | 7.8 | 2022-12-06 | In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges need… |
CVE-2022-42777 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-42776 | High | 7.8 | 2022-12-06 | In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed. |
CVE-2022-42766 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-39102 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39101 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39100 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39099 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39098 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39097 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39096 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39095 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39094 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39093 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39092 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39091 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39090 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-44009 | High | 7.5 | 2022-12-06 | Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of… |
CVE-2022-41807 | Medium | 6.5 | 2022-12-05 | Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product se… |
CVE-2022-32966 | Medium | 6.5 | 2022-11-29 | RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service por… |
CVE-2022-24190 | High | 7.5 | 2022-11-28 | The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or p… |
CVE-2022-4169 | Medium | 6.5 | 2022-11-28 | The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks i… |
CVE-2022-41930 | High | 7.5 | 2022-11-23 | org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWik… |
CVE-2022-41929 | Medium | 4.9 | 2022-11-23 | org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script r… |