CWE-862 · Missing Authorization (page 80)
Page 80 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41254 | Medium | 6.5 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP ser… |
CVE-2022-41252 | Medium | 4.3 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stor… |
CVE-2022-41251 | Medium | 4.3 | 2022-09-21 | A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IDs of credentials s… |
CVE-2022-41250 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified H… |
CVE-2022-41246 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2022-41242 | Medium | 5.4 | 2022-09-21 | A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job n… |
CVE-2022-41238 | Critical | 9.8 | 2022-09-21 | A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker… |
CVE-2022-41234 | High | 8.8 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trig… |
CVE-2022-41233 | Medium | 4.3 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permis… |
CVE-2022-41230 | Medium | 4.3 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obt… |
CVE-2022-41228 | High | 8.8 | 2022-09-21 | A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to co… |
CVE-2022-39960 | Medium | 5.3 | 2022-09-17 | The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all gro… |
CVE-2022-40673 | High | 7.8 | 2022-09-14 | KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache. |
CVE-2022-39119 | High | 7.8 | 2022-09-09 | In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2022-36856 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission. |
CVE-2022-36091 | High | 7.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects t… |
CVE-2022-31167 | High | 7.1 | 2022-09-07 | XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13… |
CVE-2022-2461 | Medium | 5.3 | 2022-09-06 | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and includin… |
CVE-2022-38367 | Medium | 5.3 | 2022-09-05 | The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all user… |
CVE-2022-2657 | Medium | 4.3 | 2022-09-05 | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could all… |
CVE-2022-2543 | Medium | 6.1 | 2022-09-05 | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowin… |
CVE-2022-2376 | Medium | 5.3 | 2022-09-05 | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticate… |
CVE-2022-38370 | High | 7.5 | 2022-09-05 | Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should up… |
CVE-2022-36642 | Critical | 9.8 | 2022-09-02 | A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentia… |
CVE-2022-2373 | Medium | 5.3 | 2022-08-29 | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPr… |
CVE-2022-36226 | High | 7.2 | 2022-08-26 | SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx. |
CVE-2022-32769 | Medium | 5.0 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32768 | Medium | 4.2 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-2552 | Medium | 5.3 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software… |
CVE-2022-2389 | Medium | 4.3 | 2022-08-22 | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not hav… |
CVE-2022-2382 | Medium | 4.3 | 2022-08-22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authen… |
CVE-2022-2377 | Medium | 4.3 | 2022-08-22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary… |
CVE-2022-2276 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete ar… |
CVE-2022-25810 | Medium | 6.5 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin… |
CVE-2022-2841 | Low | 2.7 | 2022-08-22 | A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2022-36024 | High | 7.5 | 2022-08-18 | py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the… |
CVE-2022-2846 | Medium | 4.3 | 2022-08-16 | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacki… |
CVE-2022-2379 | High | 7.5 | 2022-08-15 | The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to… |
CVE-2022-38183 | Medium | 6.5 | 2022-08-12 | In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to an… |
CVE-2022-20341 | Medium | 5.5 | 2022-08-12 | In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of… |
CVE-2022-20340 | Low | 3.3 | 2022-08-12 | In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. This could lead to lo… |
CVE-2022-20336 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible installed application disclosure due to a missing permission check. This could lead to local information disclosure of applica… |
CVE-2022-20335 | Low | 3.3 | 2022-08-12 | In Wifi Slice, there is a possible way to adjust Wi-Fi settings even when the permission has been disabled due to a missing permission check. This could lead t… |
CVE-2022-20330 | Low | 3.5 | 2022-08-12 | In Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user awareness due to a missing permission check. This could lead to l… |
CVE-2022-20329 | High | 7.8 | 2022-08-12 | In Wifi, there is a possible way to enable Wifi without permissions due to a missing permission check. This could lead to local escalation of privilege with no… |
CVE-2022-20328 | Low | 3.3 | 2022-08-12 | In PackageManager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information dis… |
CVE-2022-20327 | Low | 2.8 | 2022-08-12 | In Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local informatio… |
CVE-2022-20326 | Medium | 5.5 | 2022-08-12 | In Telephony, there is a possible disclosure of SIM identifiers due to a missing permission check. This could lead to local information disclosure with User ex… |
CVE-2022-20323 | Medium | 5.5 | 2022-08-12 | In PackageManager, there is a possible package installation disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2022-20322 | Medium | 5.5 | 2022-08-12 | In PackageManager, there is a possible installed package disclosure due to a missing permission check. This could lead to local information disclosure with no… |
CVE-2022-20321 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible way for an application without permissions to read content of WiFi QR codes due to a missing permission check. This could lead… |
CVE-2022-20315 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure wit… |
CVE-2022-20312 | Medium | 5.5 | 2022-08-12 | In WifiP2pManager, there is a possible toobtain WiFi P2P MAC address without user consent due to missing permission check. This could lead to local information… |
CVE-2022-20311 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |
CVE-2022-20310 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |
CVE-2022-20305 | Low | 3.3 | 2022-08-12 | In ContentService, there is a possible disclosure of available account types due to a missing permission check. This could lead to local information disclosure… |
CVE-2022-20303 | Medium | 5.5 | 2022-08-12 | In ContentService, there is a possible way to determine if an account is on the device without GET_ACCOUNTS permission due to a missing permission check. This… |
CVE-2022-20301 | Medium | 5.5 | 2022-08-12 | In Content, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information disclos… |
CVE-2022-20300 | Medium | 5.5 | 2022-08-12 | In Content, there is a possible way to check if the given account exists on the device due to a missing permission check. This could lead to local information… |
CVE-2022-20299 | Medium | 5.5 | 2022-08-12 | In ContentService, there is a possible way to check if the given account exists on the device due to a missing permission check. This could lead to local infor… |
CVE-2022-20298 | Medium | 5.5 | 2022-08-12 | In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information… |
CVE-2022-20296 | Medium | 5.5 | 2022-08-12 | In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information… |
CVE-2022-20295 | Medium | 5.5 | 2022-08-12 | In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information… |
CVE-2022-20294 | Medium | 5.5 | 2022-08-12 | In Content, there is a possible way to learn about an account present on the device due to a missing permission check. This could lead to local information dis… |
CVE-2022-20284 | Medium | 5.5 | 2022-08-12 | In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of phone accounts w… |
CVE-2022-20282 | High | 7.8 | 2022-08-12 | In AppWidget, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privil… |
CVE-2022-20281 | High | 7.8 | 2022-08-12 | In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege w… |
CVE-2022-20274 | High | 7.8 | 2022-08-12 | In Keyguard, there is a missing permission check. This could lead to local escalation of privilege and prevention of screen timeout with User execution privile… |
CVE-2022-20267 | Low | 3.3 | 2022-08-12 | In bluetooth, there is a possible way to enable or disable bluetooth connection without user consent due to a missing permission check. This could lead to loca… |
CVE-2022-20263 | Medium | 5.5 | 2022-08-12 | In ActivityManager, there is a way to read process state for other users due to a missing permission check. This could lead to local information disclosure of… |
CVE-2022-20262 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information dis… |
CVE-2022-20261 | Low | 2.3 | 2022-08-12 | In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with… |
CVE-2022-20259 | Medium | 5.5 | 2022-08-12 | In Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This could lead to local information disclosure with no additional e… |
CVE-2022-20255 | Medium | 4.4 | 2022-08-12 | In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to local escalation of p… |
CVE-2021-0735 | Medium | 5.5 | 2022-08-11 | In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permissio… |
CVE-2022-35293 | Critical | 9.1 | 2022-08-10 | Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker… |
CVE-2022-20360 | High | 7.8 | 2022-08-10 | In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user… |
CVE-2022-20358 | Low | 3.3 | 2022-08-10 | In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. T… |
CVE-2022-20352 | Medium | 5.5 | 2022-08-10 | In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing per… |
CVE-2022-20349 | High | 7.8 | 2022-08-10 | In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing permission check… |
CVE-2022-20348 | High | 7.8 | 2022-08-10 | In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This c… |
CVE-2022-2732 | High | 8.3 | 2022-08-09 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-1323 | Medium | 6.5 | 2022-08-08 | The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users… |
CVE-2022-36836 | Medium | 6.2 | 2022-08-05 | Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission. |
CVE-2022-2459 | Low | 2.7 | 2022-08-05 | An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2… |
CVE-2022-31128 | Medium | 5.4 | 2022-08-01 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify per… |
CVE-2022-26429 | High | 7.8 | 2022-08-01 | In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege… |
CVE-2022-2370 | Medium | 6.5 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any aut… |
CVE-2022-2369 | Medium | 4.3 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs o… |
CVE-2022-36921 | High | 8.1 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2022-36919 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-36918 | Medium | 4.3 | 2022-07-27 | Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36917 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup. |
CVE-2022-36915 | Medium | 4.3 | 2022-07-27 | Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Rea… |
CVE-2022-36914 | Medium | 4.3 | 2022-07-27 | Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overal… |
CVE-2022-36913 | Medium | 4.3 | 2022-07-27 | Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36912 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2022-36910 | Medium | 5.4 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read… |
CVE-2022-36909 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of a… |
CVE-2022-36907 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |