CWE-862 · Missing Authorization (page 83)
Page 83 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25190 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cr… |
CVE-2022-0588 | High | 7.1 | 2022-02-15 | Missing Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0579 | Medium | 6.5 | 2022-02-14 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. |
CVE-2022-22854 | High | 8.8 | 2022-02-14 | An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing… |
CVE-2021-25018 | Medium | 5.4 | 2022-02-14 | The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any a… |
CVE-2021-25014 | Low | 3.5 | 2022-02-14 | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated… |
CVE-2021-39662 | High | 7.8 | 2022-02-11 | In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission c… |
CVE-2022-24317 | High | 7.5 | 2022-02-09 | A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Intera… |
CVE-2022-22535 | Medium | 6.5 | 2022-02-09 | SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certa… |
CVE-2022-20043 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2022-20041 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2022-20024 | High | 7.8 | 2022-02-09 | In system service, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2022-23621 | Medium | 5.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can re… |
CVE-2022-23617 | Medium | 6.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy… |
CVE-2022-21660 | High | 8.1 | 2022-02-09 | Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users… |
CVE-2022-24450 | High | 8.8 | 2022-02-08 | NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically… |
CVE-2021-25095 | High | 7.1 | 2022-02-07 | The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX a… |
CVE-2021-25084 | Medium | 4.3 | 2022-02-07 | The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of… |
CVE-2021-24993 | Medium | 6.5 | 2022-02-07 | The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticat… |
CVE-2021-24839 | High | 7.5 | 2022-02-07 | The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated u… |
CVE-2022-0218 | High | 8.3 | 2022-02-04 | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a mi… |
CVE-2021-25093 | High | 7.5 | 2022-02-01 | The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary lin… |
CVE-2021-44795 | Medium | 5.3 | 2022-01-27 | Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to… |
CVE-2021-44794 | Medium | 5.3 | 2022-01-27 | Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access t… |
CVE-2021-44793 | High | 8.6 | 2022-01-27 | Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerability to access the d… |
CVE-2021-44792 | Medium | 5.3 | 2022-01-27 | Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerability to access the lo… |
CVE-2022-0203 | Medium | 5.3 | 2022-01-26 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. |
CVE-2022-23945 | High | 7.5 | 2022-01-25 | Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2022-23944 | Critical | 9.1 | 2022-01-25 | User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2021-25013 | Medium | 6.5 | 2022-01-24 | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the… |
CVE-2021-24968 | Medium | 5.7 | 2022-01-24 | The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX… |
CVE-2021-24906 | High | 7.5 | 2022-01-24 | The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users… |
CVE-2022-21707 | Medium | 6.3 | 2022-01-21 | wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior… |
CVE-2021-38789 | High | 7.5 | 2022-01-19 | Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-pa… |
CVE-2021-44840 | Low | 2.7 | 2022-01-18 | An issue was discovered in Delta RM 1.2. Using an privileged account, it is possible to edit, create, and delete risk labels, such as Criticality and Priority… |
CVE-2022-0236 | High | 7.5 | 2022-01-18 | The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability c… |
CVE-2022-0152 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0125 | Medium | 4.3 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2021-4074 | Medium | 6.4 | 2022-01-18 | The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php… |
CVE-2021-25025 | Medium | 4.3 | 2022-01-17 | The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with… |
CVE-2021-39622 | High | 7.8 | 2022-01-14 | In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2021-1037 | Medium | 5.3 | 2022-01-14 | The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This le… |
CVE-2022-0178 | Medium | 6.3 | 2022-01-13 | Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8. |
CVE-2021-40327 | Medium | 5.9 | 2022-01-13 | Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based sole… |
CVE-2022-23112 | Medium | 6.5 | 2022-01-12 | A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SS… |
CVE-2022-20620 | Medium | 4.3 | 2022-01-12 | Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials st… |
CVE-2022-20618 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate crede… |
CVE-2022-20616 | Medium | 4.3 | 2022-01-12 | Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overa… |
CVE-2022-20614 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenki… |
CVE-2022-0179 | Medium | 5.4 | 2022-01-12 | snipe-it is vulnerable to Missing Authorization |
CVE-2021-25032 | Critical | 9.8 | 2022-01-10 | The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF c… |
CVE-2021-46075 | High | 7.2 | 2022-01-06 | A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and per… |
CVE-2022-22111 | High | 8.8 | 2022-01-05 | In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able t… |
CVE-2022-22108 | Medium | 4.3 | 2022-01-05 | In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user)… |
CVE-2022-22107 | Medium | 4.3 | 2022-01-05 | In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user)… |
CVE-2021-24831 | High | 7.5 | 2022-01-03 | All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to… |
CVE-2021-20873 | High | 8.1 | 2021-12-28 | Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed wi… |
CVE-2021-24997 | Medium | 6.5 | 2021-12-27 | The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to se… |
CVE-2021-24988 | Medium | 5.4 | 2021-12-27 | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lea… |
CVE-2021-37572 | High | 8.2 | 2021-12-26 | MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle IEEE 1905 protocols. (Affected Chipsets MT7603E, MT7613, MT7615… |
CVE-2021-43847 | Medium | 6.5 | 2021-12-20 | HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauth… |
CVE-2021-40853 | High | 7.2 | 2021-12-17 | TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL… |
CVE-2021-0673 | High | 7.8 | 2021-12-17 | In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2021-44857 | Medium | 6.5 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcr… |
CVE-2021-27859 | High | 8.8 | 2021-12-15 | A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 a… |
CVE-2021-27858 | Medium | 5.3 | 2021-12-15 | A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 a… |
CVE-2021-27857 | High | 7.5 | 2021-12-15 | A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 a… |
CVE-2021-27855 | High | 8.8 | 2021-12-15 | FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant… |
CVE-2021-39651 | High | 7.8 | 2021-12-15 | In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check. This could lead to local… |
CVE-2021-39639 | Medium | 6.8 | 2021-12-15 | In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. This could lead to local escalation of privilege with physic… |
CVE-2021-1034 | Low | 3.3 | 2021-12-15 | In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without querypermissions due to a m… |
CVE-2021-1025 | Medium | 5.5 | 2021-12-15 | In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a mis… |
CVE-2021-1017 | High | 7.8 | 2021-12-15 | In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check… |
CVE-2021-1011 | Medium | 5.5 | 2021-12-15 | In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additiona… |
CVE-2021-1010 | Medium | 5.5 | 2021-12-15 | In getSigningKeySet of PackageManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional exec… |
CVE-2021-1004 | High | 7.8 | 2021-12-15 | In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing… |
CVE-2021-0999 | High | 7.8 | 2021-12-15 | In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check… |
CVE-2021-0994 | Low | 3.3 | 2021-12-15 | In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a… |
CVE-2021-0986 | Medium | 5.5 | 2021-12-15 | In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due t… |
CVE-2021-0985 | High | 7.8 | 2021-12-15 | In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. This could lead to local escalation of… |
CVE-2021-0982 | Low | 3.3 | 2021-12-15 | In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This coul… |
CVE-2021-0978 | Low | 3.3 | 2021-12-15 | In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2021-0965 | High | 8.8 | 2021-12-15 | In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission check. This could lead… |
CVE-2021-0926 | High | 7.8 | 2021-12-15 | In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission check. This could lead… |
CVE-2021-0923 | High | 7.8 | 2021-12-15 | In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalati… |
CVE-2021-0922 | High | 7.8 | 2021-12-15 | In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT_ACROSS_PROFILES permission due to a missing permis… |
CVE-2021-0653 | Medium | 5.5 | 2021-12-15 | In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This… |
CVE-2021-44233 | High | 8.8 | 2021-12-14 | SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead… |
CVE-2021-42367 | Medium | 6.4 | 2021-12-14 | The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-… |
CVE-2021-41066 | High | 7.5 | 2021-12-14 | An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files o… |
CVE-2021-24836 | Medium | 4.3 | 2021-12-13 | The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows a… |
CVE-2021-24790 | Medium | 4.3 | 2021-12-13 | The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_… |
CVE-2021-20867 | Medium | 6.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the… |
CVE-2021-20866 | Medium | 6.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining… |
CVE-2021-20865 | High | 7.5 | 2021-12-13 | Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing d… |
CVE-2021-4089 | Medium | 4.3 | 2021-12-10 | snipe-it is vulnerable to Improper Access Control |
CVE-2021-25519 | Medium | 4.0 | 2021-12-08 | An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission. |
CVE-2021-43781 | Medium | 6.4 | 2021-12-06 | Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versi… |
CVE-2021-24914 | High | 8.0 | 2021-12-06 | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, avai… |