CWE-862 · Missing Authorization (page 79)
Page 79 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43685 | High | 8.8 | 2022-11-22 | CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an exi… |
CVE-2022-41937 | Critical | 9.6 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modi… |
CVE-2022-41326 | Critical | 9.8 | 2022-11-22 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authoriza… |
CVE-2022-43482 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. |
CVE-2022-41692 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. |
CVE-2022-42903 | Low | 3.3 | 2022-11-17 | Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. |
CVE-2022-3920 | Medium | 5.3 | 2022-11-16 | HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the… |
CVE-2022-20941 | Medium | 5.3 | 2022-11-15 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to ac… |
CVE-2022-45399 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
CVE-2022-45394 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. |
CVE-2022-45390 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-45389 | Medium | 5.3 | 2022-11-15 | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-spe… |
CVE-2022-45385 | High | 7.5 | 2022-11-15 | A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of… |
CVE-2022-3538 | Medium | 6.5 | 2022-11-14 | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated user… |
CVE-2022-2450 | Medium | 4.3 | 2022-11-14 | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged… |
CVE-2022-38651 | Critical | 9.8 | 2022-11-12 | A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentic… |
CVE-2022-44549 | High | 7.5 | 2022-11-09 | The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing… |
CVE-2022-20451 | High | 7.8 | 2022-11-08 | In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalatio… |
CVE-2022-20450 | High | 7.8 | 2022-11-08 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could le… |
CVE-2022-20446 | Low | 3.3 | 2022-11-08 | In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission ch… |
CVE-2022-40223 | Medium | 5.4 | 2022-11-08 | Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change. |
CVE-2022-3489 | Medium | 5.3 | 2022-11-07 | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauth… |
CVE-2022-3451 | Medium | 4.3 | 2022-11-07 | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role… |
CVE-2022-36404 | Medium | 5.4 | 2022-11-03 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions. |
CVE-2022-2696 | Medium | 6.3 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions… |
CVE-2022-3096 | Medium | 5.4 | 2022-10-31 | The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as sub… |
CVE-2022-3400 | Medium | 6.5 | 2022-10-28 | The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1… |
CVE-2022-3512 | Medium | 6.7 | 2022-10-28 | Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-3322 | Medium | 6.7 | 2022-10-28 | Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient… |
CVE-2022-3321 | Medium | 6.7 | 2022-10-28 | It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-… |
CVE-2022-3320 | Medium | 6.7 | 2022-10-28 | It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an… |
CVE-2022-24669 | Medium | 6.5 | 2022-10-27 | It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services. |
CVE-2022-39329 | Low | 3.5 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2022-39340 | Medium | 5.3 | 2022-10-25 | OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, result… |
CVE-2022-41797 | Medium | 6.5 | 2022-10-24 | Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior t… |
CVE-2022-26423 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1070 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1066 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-43431 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read per… |
CVE-2022-43427 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/R… |
CVE-2022-43421 | Medium | 5.3 | 2022-10-19 | A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose confi… |
CVE-2022-43417 | Medium | 4.3 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-43413 | Medium | 4.3 | 2022-10-19 | Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-39233 | Medium | 4.3 | 2022-10-19 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24… |
CVE-2022-3244 | Medium | 4.2 | 2022-10-17 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access som… |
CVE-2022-3082 | Medium | 6.5 | 2022-10-17 | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users… |
CVE-2022-3501 | Low | 3.5 | 2022-10-17 | Article template contents with sensitive data could be accessed from agents without permissions. |
CVE-2022-39117 | Medium | 5.5 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-39115 | Medium | 5.5 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges need… |
CVE-2022-39114 | Medium | 5.5 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges need… |
CVE-2022-39113 | Medium | 5.5 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges need… |
CVE-2022-39112 | Medium | 5.5 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional execution privileges need… |
CVE-2022-39111 | High | 7.8 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges neede… |
CVE-2022-39110 | High | 7.8 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges neede… |
CVE-2022-39109 | High | 7.8 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges neede… |
CVE-2022-39108 | High | 7.8 | 2022-10-14 | In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges neede… |
CVE-2022-39107 | High | 7.8 | 2022-10-14 | In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution… |
CVE-2022-39103 | Medium | 5.5 | 2022-10-14 | In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges… |
CVE-2022-39080 | High | 7.8 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privilege… |
CVE-2022-38698 | High | 7.8 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privilege… |
CVE-2022-38697 | Medium | 5.5 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privi… |
CVE-2022-38689 | Medium | 5.5 | 2022-10-14 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-38688 | Medium | 5.5 | 2022-10-14 | In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-38687 | Medium | 5.5 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privile… |
CVE-2022-38679 | Medium | 5.5 | 2022-10-14 | In music service, there is a missing permission check. This could lead to local denial of service in music service with no additional execution privileges need… |
CVE-2022-38677 | Medium | 5.5 | 2022-10-14 | In cell service, there is a missing permission check. This could lead to local denial of service in cell service with no additional execution privileges needed. |
CVE-2022-38670 | High | 7.8 | 2022-10-14 | In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privi… |
CVE-2022-38669 | High | 7.8 | 2022-10-14 | In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privi… |
CVE-2022-2985 | High | 7.8 | 2022-10-14 | In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges ne… |
CVE-2022-42488 | High | 8.4 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application instal… |
CVE-2022-28866 | High | 8.8 | 2022-10-12 | Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or… |
CVE-2022-20434 | High | 7.8 | 2022-10-11 | There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.P… |
CVE-2022-20433 | High | 7.8 | 2022-10-11 | There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.P… |
CVE-2022-20432 | High | 7.8 | 2022-10-11 | There is an missing authorization issue in the system service. Since the component does not have permission check and permission protection,, resulting in Loca… |
CVE-2022-20431 | High | 7.8 | 2022-10-11 | There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.P… |
CVE-2022-20430 | High | 7.8 | 2022-10-11 | There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.P… |
CVE-2022-20394 | Medium | 5.0 | 2022-10-11 | In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an IME due to a missin… |
CVE-2022-31765 | High | 8.8 | 2022-10-11 | Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileg… |
CVE-2022-2350 | Medium | 5.3 | 2022-10-10 | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attacker… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-39861 | Medium | 5.9 | 2022-10-07 | Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege. |
CVE-2022-39222 | Critical | 9.3 | 2022-10-06 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accept… |
CVE-2022-3124 | Medium | 5.3 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack… |
CVE-2022-40316 | Medium | 4.3 | 2022-09-30 | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users… |
CVE-2022-36068 | High | 7.2 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2020-15338 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests. |
CVE-2020-15337 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests. |
CVE-2021-28052 | High | 7.5 | 2022-09-26 | A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized a… |
CVE-2022-2987 | High | 7.5 | 2022-09-26 | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (whi… |
CVE-2022-2405 | Medium | 4.3 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subs… |
CVE-2021-24890 | High | 8.8 | 2022-09-26 | The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and… |
CVE-2022-36340 | Medium | 6.5 | 2022-09-23 | Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. |
CVE-2022-35249 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channe… |
CVE-2022-35247 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak chann… |
CVE-2022-32220 | Medium | 6.5 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private chan… |
CVE-2021-41803 | High | 7.1 | 2022-09-23 | HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assert… |
CVE-2021-39190 | Medium | 5.3 | 2022-09-22 | The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly… |
CVE-2022-38512 | Medium | 6.5 | 2022-09-22 | The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user… |
CVE-2022-39975 | Medium | 4.3 | 2022-09-22 | The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission bef… |