CWE-862 · Missing Authorization (page 84)
Page 84 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35413 | High | 8.8 | 2021-12-03 | A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via… |
CVE-2021-24842 | Medium | 5.4 | 2021-11-29 | The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titl… |
CVE-2021-36917 | Medium | 6.5 | 2021-11-24 | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used… |
CVE-2021-20835 | High | 7.5 | 2021-11-24 | Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) v… |
CVE-2021-39236 | High | 8.8 | 2021-11-19 | In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. |
CVE-2021-39232 | High | 8.8 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins. |
CVE-2021-39231 | Critical | 9.1 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to d… |
CVE-2021-36909 | High | 8.8 | 2021-11-18 | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire databas… |
CVE-2021-0672 | Medium | 5.5 | 2021-11-18 | In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additiona… |
CVE-2021-24851 | Medium | 4.3 | 2021-11-17 | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardl… |
CVE-2021-42062 | Medium | 4.3 | 2021-11-10 | SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affecte… |
CVE-2021-40502 | High | 8.8 | 2021-11-10 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation o… |
CVE-2021-40501 | High | 8.1 | 2021-11-10 | SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in es… |
CVE-2021-42359 | High | 7.5 | 2021-11-05 | WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthe… |
CVE-2021-21694 | Critical | 9.8 | 2021-11-04 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and e… |
CVE-2021-21688 | High | 7.5 | 2021-11-04 | The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allo… |
CVE-2021-21687 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FileP… |
CVE-2021-21685 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. |
CVE-2020-25366 | Critical | 9.1 | 2021-11-04 | An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vec… |
CVE-2021-41238 | High | 8.6 | 2021-11-02 | Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate process required. Da… |
CVE-2018-25019 | High | 7.5 | 2021-11-01 | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_i… |
CVE-2015-20067 | High | 7.5 | 2021-11-01 | The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds… |
CVE-2021-39225 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authe… |
CVE-2021-24779 | Medium | 6.5 | 2021-10-25 | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a… |
CVE-2021-0706 | Medium | 5.5 | 2021-10-22 | In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to… |
CVE-2021-0643 | Medium | 5.5 | 2021-10-22 | In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissions due to a missin… |
CVE-2021-31384 | High | 7.2 | 2021-10-19 | Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Ne… |
CVE-2021-30810 | Medium | 4.3 | 2021-10-19 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15, watchOS 8, tvOS 15. An attacker in physical p… |
CVE-2021-38486 | High | 8.0 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements… |
CVE-2021-24677 | Medium | 5.3 | 2021-10-18 | The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate priva… |
CVE-2021-37738 | High | 7.5 | 2021-10-15 | A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior t… |
CVE-2021-38431 | Medium | 4.3 | 2021-10-15 | An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users. |
CVE-2021-42331 | Medium | 5.4 | 2021-10-15 | The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can acces… |
CVE-2021-20834 | Medium | 6.1 | 2021-10-13 | Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2… |
CVE-2021-39184 | Medium | 6.8 | 2021-10-12 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, an… |
CVE-2021-40884 | High | 8.1 | 2021-10-11 | Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id para… |
CVE-2021-37976 | Medium | 6.5 | 2021-10-08 | Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2021-32172 | Critical | 9.8 | 2021-10-07 | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. |
CVE-2021-0686 | Medium | 5.5 | 2021-10-06 | In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a mi… |
CVE-2021-0682 | Medium | 5.5 | 2021-10-06 | In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could… |
CVE-2021-0681 | Medium | 5.5 | 2021-10-06 | In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2021-0680 | Medium | 5.5 | 2021-10-06 | In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2021-39226 | Critical | 9.8 | 2021-10-05 | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowe… |
CVE-2021-41554 | High | 8.8 | 2021-10-05 | ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /ar… |
CVE-2021-39893 | Medium | 5.3 | 2021-10-05 | A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. |
CVE-2021-39347 | Medium | 4.3 | 2021-10-04 | The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit… |
CVE-2021-41729 | Critical | 9.1 | 2021-09-30 | BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/pps… |
CVE-2021-3653 | High | 8.8 | 2021-09-29 | A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provi… |
CVE-2021-33924 | Critical | 9.8 | 2021-09-29 | Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote a… |
CVE-2021-37270 | Critical | 9.8 | 2021-09-27 | There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access th… |
CVE-2021-24633 | Medium | 4.3 | 2021-09-27 | The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2021-24639 | High | 8.1 | 2021-09-20 | The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any… |
CVE-2021-24635 | Medium | 5.4 | 2021-09-20 | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authentic… |
CVE-2021-33704 | High | 8.8 | 2021-09-15 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to speci… |
CVE-2021-22149 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using… |
CVE-2021-22147 | Medium | 6.5 | 2021-09-15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to… |
CVE-2021-41077 | High | 7.5 | 2021-09-14 | The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by t… |
CVE-2021-38164 | Medium | 5.4 | 2021-09-14 | SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4C… |
CVE-2021-37535 | Critical | 9.8 | 2021-09-14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo… |
CVE-2021-38388 | High | 8.8 | 2021-09-08 | Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. |
CVE-2020-24672 | Critical | 9.8 | 2021-09-08 | A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue aff… |
CVE-2021-30713 | High | 7.8 | 2021-09-08 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy pr… |
CVE-2021-30657 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious applicati… |
CVE-2021-1835 | Medium | 4.6 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. A person with physical access to an iOS device may be able to a… |
CVE-2021-38698 | Medium | 6.5 | 2021-09-07 | HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. F… |
CVE-2021-40379 | High | 7.5 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization. |
CVE-2021-40378 | High | 8.1 | 2021-09-01 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device. |
CVE-2021-36232 | High | 8.8 | 2021-08-31 | Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges. |
CVE-2021-40088 | Medium | 5.4 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The… |
CVE-2021-30874 | High | 7.5 | 2021-08-24 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. A VPN configuration may be installed by an ap… |
CVE-2020-27466 | High | 7.8 | 2021-08-20 | An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file. |
CVE-2020-27464 | High | 7.8 | 2021-08-20 | An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file. |
CVE-2020-25359 | Critical | 9.1 | 2021-08-20 | An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to… |
CVE-2021-0415 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2021-0642 | Medium | 5.5 | 2021-08-17 | In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check… |
CVE-2021-0641 | Medium | 5.5 | 2021-08-17 | In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. Thi… |
CVE-2021-38755 | Medium | 5.3 | 2021-08-16 | Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php. |
CVE-2020-18757 | High | 7.5 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet. |
CVE-2020-18753 | Critical | 9.8 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a crafted packet. |
CVE-2021-24501 | High | 8.1 | 2021-08-09 | The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operat… |
CVE-2021-24500 | High | 8.1 | 2021-08-09 | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that… |
CVE-2021-35327 | Critical | 9.8 | 2021-08-05 | A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials v… |
CVE-2021-33197 | Medium | 5.3 | 2021-08-02 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to… |
CVE-2021-34629 | Medium | 4.3 | 2021-07-30 | The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file… |
CVE-2020-20698 | High | 7.2 | 2021-07-30 | A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file. |
CVE-2020-11511 | High | 8.1 | 2021-07-30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher… |
CVE-2020-36239 | Critical | 9.8 | 2021-07-29 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Ji… |
CVE-2021-32748 | Medium | 4.3 | 2021-07-27 | Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicat… |
CVE-2020-12734 | High | 8.1 | 2021-07-15 | DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful device owner, because… |
CVE-2021-0654 | Medium | 5.5 | 2021-07-14 | In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure… |
CVE-2021-0597 | Medium | 5.5 | 2021-07-14 | In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. Thi… |
CVE-2021-0518 | Medium | 5.5 | 2021-07-14 | In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additi… |
CVE-2021-33676 | High | 7.2 | 2021-07-14 | A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentia… |
CVE-2021-33671 | High | 8.8 | 2021-07-14 | SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an… |
CVE-2021-20747 | Medium | 4.3 | 2021-07-14 | Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to… |
CVE-2021-36124 | Critical | 9.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, le… |
CVE-2020-19038 | Critical | 9.1 | 2021-07-12 | File Deletion vulnerability in Halo 0.4.3 via delBackup. |
CVE-2021-22233 | Medium | 4.3 | 2021-07-07 | An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details |