CWE-862 · Missing Authorization (page 85)
Page 85 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20777 | Medium | 4.3 | 2021-07-07 | Improper authorization in handler for custom URL scheme vulnerability in GU App for Android versions from 4.8.0 to 5.0.2 allows a remote attacker to lead a use… |
CVE-2021-21676 | Medium | 4.3 | 2021-06-30 | Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to se… |
CVE-2021-27903 | Critical | 9.8 | 2021-06-30 | An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restric… |
CVE-2021-29958 | Medium | 4.3 | 2021-06-24 | When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in no… |
CVE-2020-22176 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can expl… |
CVE-2021-0547 | High | 7.8 | 2021-06-22 | In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission chec… |
CVE-2021-0539 | High | 7.8 | 2021-06-22 | In archiveStoredConversation of MmsService.java, there is a possible way to archive message conversation without user consent due to a missing permission check… |
CVE-2021-0568 | High | 7.8 | 2021-06-22 | In onReceive of DevicePolicyManagerService.java, there is a possible enabling of disabled profiles due to a missing permission check. This could lead to local… |
CVE-2021-0554 | Medium | 5.5 | 2021-06-22 | In isBackupServiceActive of BackupManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2021-20733 | Medium | 6.1 | 2021-06-22 | Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット (asken diet) for Android versions from v.3.0.0 to v.4.2.x allows a remote at… |
CVE-2021-0521 | Medium | 5.5 | 2021-06-21 | In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information… |
CVE-2021-0513 | High | 7.8 | 2021-06-21 | In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper state validation… |
CVE-2021-0505 | High | 7.8 | 2021-06-21 | In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. This could lead to local escalation of privilege wi… |
CVE-2020-20444 | High | 7.2 | 2021-06-16 | Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view… |
CVE-2021-24356 | High | 8.8 | 2021-06-14 | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple30… |
CVE-2021-24355 | Medium | 4.3 | 2021-06-14 | In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simpl… |
CVE-2021-24354 | High | 8.8 | 2021-06-14 | A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it p… |
CVE-2021-24353 | High | 8.8 | 2021-06-14 | The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unau… |
CVE-2021-24352 | High | 8.8 | 2021-06-14 | The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unau… |
CVE-2021-21382 | High | 8.6 | 2021-06-11 | Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to rea… |
CVE-2021-0491 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege wi… |
CVE-2021-23204 | High | 8.1 | 2021-06-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command C… |
CVE-2021-22896 | Medium | 4.3 | 2021-06-11 | Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases fo… |
CVE-2021-25409 | Low | 2.4 | 2021-06-11 | Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically conf… |
CVE-2021-33031 | Low | 3.1 | 2021-06-10 | In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, af… |
CVE-2020-13938 | Medium | 5.5 | 2021-06-10 | Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows |
CVE-2021-21473 | Medium | 6.3 | 2021-06-09 | SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_RE… |
CVE-2021-32015 | Medium | 6.0 | 2021-06-08 | In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-vo… |
CVE-2021-31921 | Critical | 9.8 | 2021-06-02 | Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster… |
CVE-2021-32652 | High | 8.8 | 2021-06-01 | Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users… |
CVE-2020-10701 | Medium | 6.5 | 2021-05-27 | A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to a… |
CVE-2020-10697 | Medium | 4.4 | 2021-05-27 | A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbo… |
CVE-2021-22891 | Critical | 9.8 | 2021-05-27 | A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthentica… |
CVE-2018-10866 | Critical | 9.1 | 2021-05-26 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remov… |
CVE-2018-10865 | High | 7.5 | 2021-05-26 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call… |
CVE-2020-4669 | Critical | 9.1 | 2021-05-17 | IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configu… |
CVE-2021-32917 | Medium | 5.3 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the… |
CVE-2021-23014 | High | 8.8 | 2021-05-10 | On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploa… |
CVE-2021-27573 | Critical | 9.8 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior au… |
CVE-2021-21984 | Critical | 9.8 | 2021-05-07 | VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with n… |
CVE-2021-32093 | Medium | 6.5 | 2021-05-07 | The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName pa… |
CVE-2021-32095 | High | 8.1 | 2021-05-07 | U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files. |
CVE-2020-18888 | High | 7.5 | 2021-05-06 | Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php. |
CVE-2021-1508 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1506 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-1505 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2021-21264 | Medium | 5.2 | 2021-05-03 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was di… |
CVE-2021-20715 | Medium | 4.3 | 2021-04-27 | Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attack… |
CVE-2021-20693 | High | 7.5 | 2021-04-26 | Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a… |
CVE-2021-27609 | Medium | 6.5 | 2021-04-13 | SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and… |
CVE-2021-27605 | Medium | 4.3 | 2021-04-13 | SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to r… |
CVE-2021-27598 | Medium | 5.3 | 2021-04-13 | SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version… |
CVE-2021-0428 | Medium | 5.5 | 2021-04-13 | In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. This could lead to lo… |
CVE-2021-21432 | High | 7.5 | 2021-04-09 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enabl… |
CVE-2021-30155 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permission… |
CVE-2020-36287 | Medium | 5.3 | 2021-04-09 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14… |
CVE-2021-22513 | Medium | 6.5 | 2021-04-08 | Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier vers… |
CVE-2021-27900 | High | 8.1 | 2021-04-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables… |
CVE-2020-13422 | High | 8.1 | 2021-04-06 | OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actions. |
CVE-2021-24184 | High | 8.8 | 2021-04-05 | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify cour… |
CVE-2021-24164 | Medium | 4.3 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and… |
CVE-2021-24163 | High | 8.8 | 2021-04-05 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore maki… |
CVE-2021-1755 | Low | 2.4 | 2021-04-02 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Big Su… |
CVE-2020-29621 | Medium | 5.5 | 2021-04-02 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A… |
CVE-2020-36238 | Medium | 5.3 | 2021-04-01 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 befor… |
CVE-2021-21637 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2021-21636 | Medium | 4.3 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2021-21632 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2021-21631 | Medium | 4.3 | 2021-03-30 | Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and k… |
CVE-2021-28669 | High | 7.5 | 2021-03-29 | Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 pr… |
CVE-2021-21437 | Low | 3.5 | 2021-03-22 | Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and… |
CVE-2021-26990 | Critical | 9.1 | 2021-03-19 | Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files. |
CVE-2021-27656 | Medium | 5.3 | 2021-03-18 | A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision W… |
CVE-2021-24146 | High | 7.5 | 2021-03-18 | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files… |
CVE-2021-21626 | Medium | 4.3 | 2021-03-18 | Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with… |
CVE-2021-21625 | Medium | 4.3 | 2021-03-18 | Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Ov… |
CVE-2021-20283 | Medium | 4.3 | 2021-03-15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in eac… |
CVE-2021-28375 | High | 7.8 | 2021-03-15 | An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending k… |
CVE-2021-28154 | Critical | 9.1 | 2021-03-11 | Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ip… |
CVE-2020-14987 | High | 7.2 | 2021-03-11 | An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a m… |
CVE-2021-28141 | Critical | 9.8 | 2021-03-11 | An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebRes… |
CVE-2021-0389 | High | 7.8 | 2021-03-10 | In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2021-0388 | High | 7.8 | 2021-03-10 | In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local esca… |
CVE-2021-0385 | High | 7.8 | 2021-03-10 | In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to no… |
CVE-2021-0380 | High | 7.8 | 2021-03-10 | In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. Th… |
CVE-2021-0390 | High | 7.8 | 2021-03-10 | In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could… |
CVE-2021-21487 | High | 8.8 | 2021-03-09 | SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2021-21486 | High | 8.8 | 2021-03-09 | SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization chec… |
CVE-2021-21327 | Medium | 6.8 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-21326 | High | 7.7 | 2021-03-08 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI befo… |
CVE-2021-25344 | Medium | 6.2 | 2021-03-04 | Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission. |
CVE-2021-26988 | Low | 3.5 | 2021-03-04 | Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to… |
CVE-2021-22877 | Medium | 6.5 | 2021-03-03 | A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not alre… |
CVE-2021-21978 | Critical | 9.8 | 2021-03-03 | VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leadi… |
CVE-2021-21255 | Medium | 5.8 | 2021-03-02 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI vers… |
CVE-2021-0403 | Medium | 4.4 | 2021-02-26 | In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution… |
CVE-2021-23975 | Medium | 6.5 | 2021-02-26 | The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoke… |
CVE-2021-21307 | High | 8.6 | 2021-02-11 | Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47… |
CVE-2021-0328 | High | 7.8 | 2021-02-10 | In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing… |
CVE-2020-10858 | Medium | 5.3 | 2021-02-05 | Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler. |