CWE-862 · Missing Authorization (page 81)
Page 81 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36904 | Medium | 4.3 | 2022-07-27 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Ove… |
CVE-2022-36903 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-36898 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36897 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate host… |
CVE-2022-36896 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read pe… |
CVE-2022-36895 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36893 | Medium | 4.3 | 2022-07-27 | Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36892 | Medium | 4.3 | 2022-07-27 | Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36891 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/… |
CVE-2022-36888 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credential… |
CVE-2022-36883 | High | 7.5 | 2022-07-27 | A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-sp… |
CVE-2021-33057 | High | 7.5 | 2022-07-26 | The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the d… |
CVE-2021-32504 | Medium | 5.3 | 2022-07-19 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2022-2108 | Medium | 6.5 | 2022-07-18 | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capabil… |
CVE-2022-20225 | Medium | 5.5 | 2022-07-13 | In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lea… |
CVE-2022-31597 | Medium | 5.4 | 2022-07-12 | Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform… |
CVE-2022-31592 | Medium | 4.3 | 2022-07-12 | The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary… |
CVE-2022-1245 | Critical | 9.8 | 2022-07-08 | A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token… |
CVE-2022-21777 | High | 7.8 | 2022-07-06 | In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execu… |
CVE-2022-21764 | Medium | 5.5 | 2022-07-06 | In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2022-21763 | Medium | 5.5 | 2022-07-06 | In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2022-34818 | Medium | 4.3 | 2022-06-30 | Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall… |
CVE-2022-34813 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XP… |
CVE-2022-34811 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Con… |
CVE-2022-34810 | Medium | 6.5 | 2022-06-30 | A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenki… |
CVE-2022-34798 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read perm… |
CVE-2022-34796 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34794 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specifie… |
CVE-2022-34781 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2022-34779 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-1903 | High | 8.1 | 2022-06-27 | The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX… |
CVE-2022-1574 | Critical | 9.8 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthent… |
CVE-2022-1572 | High | 8.1 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscrib… |
CVE-2022-0444 | Medium | 4.3 | 2022-06-27 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resettin… |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2022-34212 | Medium | 5.7 | 2022-06-23 | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request t… |
CVE-2022-34210 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2022-34208 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-34206 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to… |
CVE-2022-34204 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP serv… |
CVE-2022-34201 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2021-26637 | High | 8.8 | 2022-06-23 | There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can… |
CVE-2022-23055 | | 2022-06-22 | In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send… | |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-33913 | High | 7.5 | 2022-06-20 | In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check. |
CVE-2021-46820 | High | 8.1 | 2022-06-16 | Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.php |
CVE-2021-37764 | High | 8.1 | 2022-06-16 | Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php. |
CVE-2022-20736 | Medium | 5.3 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a conf… |
CVE-2022-20206 | Medium | 5.5 | 2022-06-15 | In setPackageOrComponentEnabled of NotificationManagerService.java, there is a missing permission check. This could lead to local information disclosure about… |
CVE-2022-20204 | High | 7.8 | 2022-06-15 | In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission chec… |
CVE-2022-20200 | Medium | 5.5 | 2022-06-15 | In updateApState of SoftApManager.java, there is a possible leak of hotspot state due to a missing permission check. This could lead to local information discl… |
CVE-2022-20182 | Medium | 4.4 | 2022-06-15 | In handle_ramdump of pixel_loader.c, there is a possible way to create a ramdump of non-secure memory due to a missing permission check. This could lead to loc… |
CVE-2022-20172 | Medium | 5.5 | 2022-06-15 | In onbind of ShannonRcsService.java, there is a possible access to protect data due to a missing permission check. This could lead to local information disclos… |
CVE-2022-20138 | High | 7.8 | 2022-06-15 | In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED inte… |
CVE-2022-20137 | High | 7.3 | 2022-06-15 | In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check… |
CVE-2022-20133 | High | 7.8 | 2022-06-15 | In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local es… |
CVE-2022-20126 | High | 7.3 | 2022-06-15 | In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. T… |
CVE-2022-31595 | High | 8.8 | 2022-06-14 | SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2022-32560 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings. |
CVE-2022-31752 | Medium | 5.5 | 2022-06-13 | Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2022-1777 | High | 8.8 | 2022-06-13 | The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, s… |
CVE-2022-0885 | Critical | 9.8 | 2022-06-13 | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenti… |
CVE-2022-0745 | Medium | 6.5 | 2022-06-13 | The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subje… |
CVE-2021-25116 | Medium | 6.5 | 2022-06-13 | The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the i… |
CVE-2022-24896 | Medium | 4.3 | 2022-06-09 | Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify author… |
CVE-2022-1570 | Medium | 6.5 | 2022-06-08 | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authentica… |
CVE-2022-30746 | High | 7.5 | 2022-06-07 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. |
CVE-2022-30731 | Medium | 5.1 | 2022-06-07 | Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application. |
CVE-2022-21749 | Medium | 5.5 | 2022-06-06 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2022-21748 | Medium | 5.5 | 2022-06-06 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution… |
CVE-2022-1203 | Medium | 4.3 | 2022-05-30 | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option t… |
CVE-2020-4926 | Critical | 9.1 | 2022-05-24 | A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitr… |
CVE-2022-28993 | Critical | 9.8 | 2022-05-20 | Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request. |
CVE-2022-1423 | High | 7.1 | 2022-05-19 | Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before… |
CVE-2021-42851 | Medium | 6.3 | 2022-05-18 | A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account. |
CVE-2021-42848 | Medium | 4.3 | 2022-05-18 | An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device… |
CVE-2022-30959 | Medium | 6.5 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2022-30957 | Medium | 4.3 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2022-30955 | Medium | 6.5 | 2022-05-17 | Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-30954 | Medium | 6.5 | 2022-05-17 | Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-30951 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to… |
CVE-2021-33013 | High | 8.2 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information. |
CVE-2022-30594 | High | 7.8 | 2022-05-12 | The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SU… |
CVE-2022-29611 | High | 8.8 | 2022-05-11 | SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of… |
CVE-2022-20121 | Medium | 5.5 | 2022-05-10 | In getNodeValue of USCCDMPlugin.java, there is a possible disclosure of ICCID due to a missing permission check. This could lead to local information disclosur… |
CVE-2021-39738 | High | 7.8 | 2022-05-10 | In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privile… |
CVE-2022-20115 | Medium | 5.5 | 2022-05-10 | In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permission due to a missi… |
CVE-2022-20011 | Medium | 5.5 | 2022-05-10 | In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This could lead to local i… |
CVE-2022-20004 | High | 7.8 | 2022-05-10 | In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input validation. This could lead to local escalati… |
CVE-2022-1442 | High | 7.5 | 2022-05-10 | The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be… |
CVE-2022-29176 | Critical | 9.9 | 2022-05-05 | Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org u… |
CVE-2021-44055 | Medium | 5.3 | 2022-05-05 | An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers… |
CVE-2022-20102 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-28789 | Medium | 6.2 | 2022-05-03 | Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission fo… |
CVE-2022-20100 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-20098 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-20093 | High | 7.8 | 2022-05-03 | In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege wit… |
CVE-2022-20084 | High | 7.8 | 2022-05-03 | In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privi… |
CVE-2022-0952 | High | 8.8 | 2022-05-02 | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure… |
CVE-2021-25002 | High | 7.5 | 2022-05-02 | The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to acce… |