CWE-862 · Missing Authorization (page 86)
Page 86 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-29604 | Medium | 6.5 | 2021-01-29 | An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use t… |
CVE-2020-4816 | Medium | 5.9 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict T… |
CVE-2020-7343 | Medium | 5.5 | 2021-01-18 | Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a direct… |
CVE-2021-21246 | High | 8.6 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only admini… |
CVE-2020-27220 | High | 8.8 | 2021-01-14 | The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when… |
CVE-2020-9209 | Medium | 6.7 | 2021-01-13 | There is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a module are located improperly. It does not apply the directory… |
CVE-2021-1143 | Medium | 4.3 | 2021-01-13 | A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on t… |
CVE-2021-23123 | Medium | 5.3 | 2021-01-12 | An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or i… |
CVE-2021-21468 | Medium | 6.5 | 2021-01-12 | The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user… |
CVE-2021-21467 | Medium | 4.3 | 2021-01-12 | SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An… |
CVE-2020-5022 | Medium | 5.3 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining infor… |
CVE-2020-16029 | High | 8.8 | 2021-01-08 | Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fil… |
CVE-2020-16027 | Medium | 6.5 | 2021-01-08 | Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-35745 | High | 8.8 | 2021-01-07 | PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, docto… |
CVE-2020-29160 | High | 7.5 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing. |
CVE-2020-29158 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the T… |
CVE-2020-25917 | High | 8.8 | 2020-12-26 | Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" pri… |
CVE-2019-11785 | Medium | 4.3 | 2020-12-22 | Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users t… |
CVE-2019-11784 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated use… |
CVE-2019-11783 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated… |
CVE-2020-35625 | High | 8.8 | 2020-12-21 | An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call… |
CVE-2020-4841 | Medium | 5.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |
CVE-2020-13519 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (I… |
CVE-2020-13515 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (I… |
CVE-2020-13514 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-13513 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-13512 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-29480 | Low | 2.3 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest admini… |
CVE-2020-29479 | High | 8.8 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root no… |
CVE-2020-27777 | Medium | 6.7 | 2020-12-15 | A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system runni… |
CVE-2020-27057 | Low | 3.3 | 2020-12-15 | In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. This could lead to… |
CVE-2020-27056 | Low | 3.3 | 2020-12-15 | In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of package metadata with no additional executi… |
CVE-2020-27054 | High | 7.8 | 2020-12-15 | In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional exe… |
CVE-2020-27053 | Medium | 4.4 | 2020-12-15 | In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missing permission check. This could lead to… |
CVE-2020-27052 | High | 7.8 | 2020-12-15 | In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a permissions bypass. This could lead to… |
CVE-2020-27032 | Medium | 5.5 | 2020-12-15 | In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check. This could lead to local… |
CVE-2020-0497 | Medium | 5.5 | 2020-12-15 | In canUseBiometric of BiometricServiceBase, there is a missing permission check. This could lead to local information disclosure with no additional execution p… |
CVE-2020-0485 | High | 7.8 | 2020-12-15 | In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check. This could lead to… |
CVE-2020-0480 | High | 7.8 | 2020-12-15 | In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0477 | Medium | 5.5 | 2020-12-15 | In sendLinkConfigurationChangedBroadcast of ClientModeImpl.java, there is a possible information disclosure due to a missing permission check. This could lead… |
CVE-2020-0475 | High | 7.8 | 2020-12-15 | In createInputConsumer of WindowManagerService.java, there is a possible way to block and intercept input events due to a missing permission check. This could… |
CVE-2020-0468 | Medium | 5.5 | 2020-12-14 | In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check… |
CVE-2020-0459 | Low | 3.3 | 2020-12-14 | In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sensitive WiFi configuration data due to a missing permission c… |
CVE-2020-0440 | High | 7.8 | 2020-12-14 | In createVirtualDisplay of DisplayManagerService.java, there is a possible way to create a trusted virtual display due to a missing permission check. This coul… |
CVE-2020-26415 | Medium | 4.3 | 2020-12-11 | Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12… |
CVE-2020-26408 | Medium | 5.3 | 2020-12-11 | A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker… |
CVE-2020-28215 | Critical | 9.8 | 2020-12-11 | A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including informatio… |
CVE-2020-25499 | High | 8.8 | 2020-12-09 | TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execut… |
CVE-2020-26832 | High | 7.6 | 2020-12-09 | SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA… |
CVE-2020-26830 | High | 8.1 | 2020-12-09 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequ… |
CVE-2020-27349 | Medium | 5.5 | 2020-12-09 | Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions prior to 1.1.1+bzr982-… |
CVE-2020-14205 | Medium | 5.3 | 2020-12-08 | The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker… |
CVE-2020-25629 | High | 8.8 | 2020-12-08 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site admin… |
CVE-2020-23740 | High | 7.8 | 2020-12-03 | In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed programs to increase user… |
CVE-2020-25711 | Medium | 6.5 | 2020-12-03 | A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is e… |
CVE-2020-23735 | High | 7.8 | 2020-12-03 | In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constructed program to increase user privileges |
CVE-2020-2323 | Medium | 5.3 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access t… |
CVE-2020-2322 | High | 7.5 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to ge… |
CVE-2017-15680 | Medium | 6.5 | 2020-11-27 | In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data. |
CVE-2020-26212 | High | 7.7 | 2020-11-25 | GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, li… |
CVE-2020-29006 | Critical | 9.8 | 2020-11-24 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. |
CVE-2020-26231 | Medium | 5.2 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discov… |
CVE-2020-15247 | Medium | 5.2 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an… |
CVE-2020-4783 | Medium | 5.9 | 2020-11-23 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St… |
CVE-2020-27192 | High | 7.8 | 2020-11-17 | BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code int… |
CVE-2020-15349 | High | 7.8 | 2020-11-17 | BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows… |
CVE-2020-23489 | High | 8.8 | 2020-11-16 | The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to ce… |
CVE-2020-28368 | Medium | 4.4 | 2020-11-10 | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a powe… |
CVE-2020-6316 | Medium | 4.3 | 2020-11-10 | SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Autho… |
CVE-2020-26818 | High | 8.8 | 2020-11-10 | SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which… |
CVE-2020-0454 | Medium | 5.5 | 2020-11-10 | In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local inform… |
CVE-2020-0448 | Medium | 5.5 | 2020-11-10 | In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could… |
CVE-2020-0439 | High | 7.8 | 2020-11-10 | In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permission check. This could lead to local esc… |
CVE-2020-0437 | Medium | 5.5 | 2020-11-10 | In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service… |
CVE-2020-2302 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check… |
CVE-2020-28036 | Critical | 9.8 | 2020-11-02 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. |
CVE-2020-27998 | Critical | 9.8 | 2020-10-29 | An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, Dll… |
CVE-2020-16260 | High | 7.5 | 2020-10-28 | Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitati… |
CVE-2020-26649 | High | 8.1 | 2020-10-22 | AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php |
CVE-2020-15245 | Medium | 4.3 | 2020-10-19 | In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.co… |
CVE-2020-10746 | Medium | 6.1 | 2020-10-19 | A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs… |
CVE-2019-19885 | Critical | 9.1 | 2020-10-16 | In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write conf… |
CVE-2020-14185 | Medium | 5.3 | 2020-10-15 | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations res… |
CVE-2020-0420 | High | 7.8 | 2020-10-14 | In setUpdatableDriverPath of GpuService.cpp, there is a possible memory corruption due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0419 | Medium | 5.5 | 2020-10-14 | In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check… |
CVE-2020-0412 | Low | 3.3 | 2020-10-14 | In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. This could lead to local information disclosure of foreground… |
CVE-2020-0378 | Medium | 5.5 | 2020-10-14 | In onWnmFrameReceived of PasspointManager.java, there is a missing permission check. This could lead to local information disclosure of location data with User… |
CVE-2020-0246 | Medium | 5.5 | 2020-10-14 | In getCarrierPrivilegeStatus of UiccAccessRule.java, there is a missing permission check. This could lead to local information disclosure of EID data with no a… |
CVE-2020-15251 | High | 7.7 | 2020-10-13 | In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypa… |
CVE-2020-13626 | Medium | 4.6 | 2020-10-09 | OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS me… |
CVE-2020-26598 | High | 7.5 | 2020-10-06 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management component could allow an unauthorized actor to… |
CVE-2020-25781 | Medium | 4.3 | 2020-09-30 | An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly p… |
CVE-2020-13794 | Medium | 4.3 | 2020-09-30 | Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor. |
CVE-2020-13319 | Medium | 4.3 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue. |
CVE-2020-13296 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens |
CVE-2020-24718 | High | 8.2 | 2020-09-25 | bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS a… |
CVE-2020-3524 | Medium | 6.8 | 2020-09-24 | A vulnerability in the Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services… |
CVE-2020-3400 | High | 8.8 | 2020-09-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are… |
CVE-2020-2285 | Medium | 4.3 | 2020-09-23 | A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of c… |
CVE-2020-2282 | Medium | 4.3 | 2020-09-23 | Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to confi… |