CWE-862 · Missing Authorization (page 82)
Page 82 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43938 | High | 8.1 | 2022-04-29 | Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization. |
CVE-2021-44595 | High | 8.8 | 2022-04-29 | Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the Elevatio… |
CVE-2022-29906 | Critical | 9.8 | 2022-04-29 | The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin u… |
CVE-2022-1511 | Medium | 6.5 | 2022-04-28 | Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. |
CVE-2022-1092 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticate… |
CVE-2022-0634 | Medium | 4.3 | 2022-04-25 | The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a r… |
CVE-2022-0398 | Medium | 5.4 | 2022-04-25 | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which co… |
CVE-2022-0363 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenti… |
CVE-2022-0287 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated use… |
CVE-2022-25342 | High | 8.1 | 2022-04-20 | An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Broken Access Control. It does not properly val… |
CVE-2022-1384 | Medium | 4.7 | 2022-04-19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated… |
CVE-2022-1329 | High | 8.8 | 2022-04-19 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/c… |
CVE-2022-1054 | Medium | 5.3 | 2022-04-18 | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export functi… |
CVE-2022-1020 | Critical | 9.8 | 2022-04-18 | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_op… |
CVE-2022-29051 | Medium | 4.3 | 2022-04-12 | Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using at… |
CVE-2022-27669 | High | 7.5 | 2022-04-12 | An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be… |
CVE-2021-39808 | High | 7.8 | 2022-04-12 | In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improp… |
CVE-2022-27480 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require… |
CVE-2022-0919 | Medium | 5.3 | 2022-04-11 | The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated use… |
CVE-2022-0837 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS noti… |
CVE-2022-0404 | Medium | 6.5 | 2022-04-04 | The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to… |
CVE-2022-0390 | Medium | 4.3 | 2022-04-01 | Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details w… |
CVE-2021-32503 | Medium | 4.9 | 2022-04-01 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2022-26546 | Critical | 9.1 | 2022-03-31 | Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin pass… |
CVE-2022-23183 | Medium | 6.5 | 2022-03-31 | Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote… |
CVE-2022-20002 | High | 7.8 | 2022-03-30 | In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of privilege with Syste… |
CVE-2021-39768 | High | 7.8 | 2022-03-30 | In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing permission check. This could lead to local… |
CVE-2021-39758 | High | 7.8 | 2022-03-30 | In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission check. This could lead to local escala… |
CVE-2021-39753 | Medium | 5.5 | 2022-03-30 | In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check. This could lead to local… |
CVE-2021-39751 | Medium | 5.5 | 2022-03-30 | In Settings, there is a possible way to read Bluetooth device names without proper permissions due to a missing permission check. This could lead to local info… |
CVE-2021-39750 | High | 7.8 | 2022-03-30 | In PackageManager, there is a possible way to change the splash screen theme of other apps due to a missing permission check. This could lead to local escalati… |
CVE-2021-39749 | High | 7.8 | 2022-03-30 | In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check. This could lead to local escalation… |
CVE-2021-39743 | High | 7.8 | 2022-03-30 | In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check. This could lead to local escalat… |
CVE-2021-39742 | Medium | 5.5 | 2022-03-30 | In Voicemail, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure wit… |
CVE-2022-28158 | Medium | 6.5 | 2022-03-29 | A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2022-28151 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item… |
CVE-2022-28147 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for t… |
CVE-2022-28144 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-28139 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-spe… |
CVE-2022-28137 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to a… |
CVE-2022-28134 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Rea… |
CVE-2022-27658 | High | 7.5 | 2022-03-28 | Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering for furth… |
CVE-2022-0833 | Medium | 4.3 | 2022-03-28 | The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticate… |
CVE-2021-24978 | Medium | 5.3 | 2022-03-28 | The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv… |
CVE-2022-27948 | High | 7.2 | 2022-03-27 | Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hu… |
CVE-2021-3814 | High | 7.5 | 2022-03-25 | It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses ac… |
CVE-2022-24768 | Critical | 9.9 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper a… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-0229 | High | 8.1 | 2022-03-21 | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and d… |
CVE-2021-39734 | High | 7.8 | 2022-03-16 | In sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message without permissions due to a missing permission check. This cou… |
CVE-2021-39706 | High | 7.8 | 2022-03-16 | In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missing permission check. This could lead to… |
CVE-2021-39697 | High | 7.8 | 2022-03-16 | In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private directories protection due to a missing permiss… |
CVE-2022-27215 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-27211 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2022-27209 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2022-27205 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect… |
CVE-2022-27199 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2021-24950 | Medium | 5.4 | 2022-03-14 | The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authen… |
CVE-2021-32477 | Medium | 4.3 | 2022-03-11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administr… |
CVE-2021-32472 | Medium | 4.3 | 2022-03-11 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and… |
CVE-2022-0932 | Medium | 6.5 | 2022-03-11 | Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2. |
CVE-2022-0871 | Critical | 9.1 | 2022-03-11 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2021-41233 | Medium | 6.5 | 2022-03-10 | Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is… |
CVE-2022-26104 | Medium | 5.3 | 2022-03-10 | SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user… |
CVE-2022-26103 | Medium | 5.3 | 2022-03-10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to informatio… |
CVE-2022-26102 | Medium | 5.4 | 2022-03-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access conten… |
CVE-2022-20054 | High | 7.8 | 2022-03-10 | In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2022-20053 | High | 7.8 | 2022-03-10 | In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2022-20049 | Medium | 6.7 | 2022-03-10 | In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-0905 | High | 7.1 | 2022-03-10 | Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. |
CVE-2021-41241 | Medium | 4.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a gr… |
CVE-2021-41239 | Medium | 5.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumerati… |
CVE-2022-0756 | Medium | 6.5 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0755 | Medium | 4.3 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0163 | Medium | 6.5 | 2022-03-07 | The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users… |
CVE-2021-25087 | High | 7.5 | 2022-03-07 | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attacker… |
CVE-2021-3656 | High | 8.8 | 2022-03-04 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provi… |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2021-41112 | High | 8.1 | 2022-02-28 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a… |
CVE-2022-0345 | Medium | 4.3 | 2022-02-28 | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowi… |
CVE-2021-25042 | Medium | 5.4 | 2022-02-28 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allow… |
CVE-2021-25011 | Medium | 5.7 | 2022-02-28 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow… |
CVE-2021-24977 | Medium | 6.1 | 2022-02-28 | The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated us… |
CVE-2021-24730 | Medium | 4.3 | 2022-02-28 | The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, al… |
CVE-2022-24594 | Medium | 5.3 | 2022-02-25 | In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address. |
CVE-2022-0726 | Medium | 5.4 | 2022-02-23 | Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-0164 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowi… |
CVE-2021-25075 | Low | 3.5 | 2022-02-21 | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_s… |
CVE-2022-23642 | High | 8.8 | 2022-02-18 | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The se… |
CVE-2022-0543 | Critical | 10.0 | 2022-02-18 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could resul… |
CVE-2020-25718 | High | 8.8 | 2022-02-18 | A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC… |
CVE-2022-0611 | Medium | 6.3 | 2022-02-16 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-25211 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web serv… |
CVE-2022-25208 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request t… |
CVE-2022-25206 | High | 8.8 | 2022-02-15 | A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDB… |
CVE-2022-25201 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2022-25199 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SS… |
CVE-2022-25195 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2022-25193 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified we… |