CWE-862 · Missing Authorization (page 87)
Page 87 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0327 | Medium | 5.5 | 2020-09-18 | In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges ne… |
CVE-2020-0316 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed… |
CVE-2020-0299 | High | 7.8 | 2020-09-18 | In Bluetooth, there is a possible spoofing of bluetooth device metadata due to a missing permission check. This could lead to local escalation of privilege wit… |
CVE-2020-0298 | High | 7.8 | 2020-09-18 | In Bluetooth, there is a possible control over Bluetooth enabled state due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2020-0285 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0284 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0276 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0265 | Medium | 5.5 | 2020-09-18 | In Telephony, there are possible leaks of sensitive data due to missing permission checks. This could lead to local information disclosure with no additional e… |
CVE-2020-0089 | High | 7.8 | 2020-09-18 | In the audio server, there is a missing permission check. This could lead to local escalation of privilege regarding audio settings with no additional executio… |
CVE-2020-0375 | High | 7.8 | 2020-09-17 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege and the setting of supp… |
CVE-2020-0372 | Medium | 5.5 | 2020-09-17 | In ActivityManager, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2020-0343 | Medium | 5.5 | 2020-09-17 | In NetworkStatsService, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no… |
CVE-2020-0341 | High | 7.8 | 2020-09-17 | In DisplayManager, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2020-0317 | Medium | 5.5 | 2020-09-17 | In UsageStatsManager, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no a… |
CVE-2020-0314 | Medium | 5.5 | 2020-09-17 | In AudioService, there are missing permission checks. This could lead to local information disclosure of audio configuration with no additional execution privi… |
CVE-2020-0293 | Medium | 5.5 | 2020-09-17 | In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure wi… |
CVE-2020-0290 | Medium | 5.5 | 2020-09-17 | In PackageManager, there is a missing permission check. This could lead to local information disclosure across users with no additional execution privileges ne… |
CVE-2020-0289 | Medium | 5.5 | 2020-09-17 | In PackageManager, there is a missing permission check. This could lead to local information disclosure across users with no additional execution privileges ne… |
CVE-2020-0288 | Medium | 5.5 | 2020-09-17 | In PackageManager, there is a missing permission check. This could lead to local information disclosure across user boundaries with no additional execution pri… |
CVE-2020-0277 | High | 7.8 | 2020-09-17 | In NetworkPolicyManagerService, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allo… |
CVE-2020-0266 | High | 7.8 | 2020-09-17 | In factory reset protection, there is a possible FRP bypass due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2020-0387 | High | 7.8 | 2020-09-17 | In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0401 | High | 7.8 | 2020-09-17 | In setInstallerPackageName of PackageManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and granting sp… |
CVE-2020-14306 | High | 8.8 | 2020-09-16 | An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacke… |
CVE-2020-2272 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2020-2267 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbit… |
CVE-2020-2260 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP U… |
CVE-2020-2255 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2020-25283 | Critical | 9.8 | 2020-09-11 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions… |
CVE-2020-25282 | Critical | 9.8 | 2020-09-11 | An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers t… |
CVE-2020-0989 | Medium | 5.5 | 2020-09-11 | <p>An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions. An attacker who success… |
CVE-2020-2242 | Medium | 6.5 | 2020-09-01 | A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified… |
CVE-2020-13464 | Medium | 4.2 | 2020-08-31 | The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmware via the debug int… |
CVE-2020-24928 | Medium | 5.3 | 2020-08-29 | managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows attackers to obtain se… |
CVE-2020-3394 | High | 7.8 | 2020-08-27 | A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an a… |
CVE-2020-4175 | Medium | 5.9 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2020-3443 | High | 8.8 | 2020-08-26 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands… |
CVE-2020-24614 | High | 8.8 | 2020-08-25 | Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-i… |
CVE-2020-19890 | Medium | 4.9 | 2020-08-24 | DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security… |
CVE-2020-6301 | High | 8.1 | 2020-08-12 | SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settl… |
CVE-2020-6298 | High | 8.1 | 2020-08-12 | SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GM… |
CVE-2020-6273 | Medium | 4.3 | 2020-08-12 | SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working wit… |
CVE-2020-2234 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-speci… |
CVE-2020-0250 | Medium | 5.5 | 2020-08-11 | In requestCellInfoUpdateInternal of PhoneInterfaceManager.java, there is a missing permission check. This could lead to local information disclosure of locatio… |
CVE-2020-0239 | Medium | 5.5 | 2020-08-11 | In getDocumentMetadata of DocumentsContract.java, there is a possible disclosure of location metadata from a file due to a permissions bypass. This could lead… |
CVE-2020-15109 | Medium | 5.3 | 2020-08-04 | In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allo… |
CVE-2020-15943 | High | 8.1 | 2020-08-04 | An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module confi… |
CVE-2020-13523 | Low | 3.3 | 2020-08-04 | An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cau… |
CVE-2020-5396 | High | 8.8 | 2020-07-31 | VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a… |
CVE-2020-14520 | High | 7.5 | 2020-07-31 | The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the Ignition 8 (all versions prior to… |
CVE-2020-15102 | Medium | 6.5 | 2020-07-21 | In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is… |
CVE-2020-14491 | Medium | 6.5 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access priv… |
CVE-2020-0227 | High | 7.8 | 2020-07-17 | In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalati… |
CVE-2020-0107 | Medium | 5.5 | 2020-07-17 | In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local informatio… |
CVE-2020-14001 | Critical | 9.8 | 2020-07-17 | The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as templat… |
CVE-2020-15780 | Medium | 6.7 | 2020-07-15 | An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by atta… |
CVE-2020-15001 | Medium | 5.3 | 2020-07-09 | An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access… |
CVE-2020-5368 | Critical | 9.8 | 2020-07-06 | Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability… |
CVE-2020-15518 | High | 8.8 | 2020-07-03 | VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achie… |
CVE-2020-15080 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The proble… |
CVE-2020-2216 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2020-2204 | Medium | 5.4 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally confi… |
CVE-2020-2202 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2020-15412 | Medium | 4.3 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contac… |
CVE-2020-15360 | High | 7.8 | 2020-06-27 | com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification. |
CVE-2020-4413 | Medium | 5.9 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |
CVE-2020-5345 | Medium | 6.4 | 2020-06-23 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Relea… |
CVE-2020-14971 | High | 7.8 | 2020-06-23 | Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occ… |
CVE-2020-14944 | Critical | 9.8 | 2020-06-22 | Global RADAR BSA Radar 1.6.7234.24750 and earlier lacks valid authorization controls in multiple functions. This can allow for manipulation and takeover of use… |
CVE-2020-14969 | High | 7.5 | 2020-06-22 | app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metada… |
CVE-2020-13276 | High | 7.4 | 2020-06-19 | User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1 |
CVE-2019-20887 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can r… |
CVE-2019-20885 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file. |
CVE-2018-21257 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Chan… |
CVE-2018-21251 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the… |
CVE-2020-3245 | Medium | 5.3 | 2020-06-18 | A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrar… |
CVE-2020-14213 | Medium | 5.4 | 2020-06-16 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). |
CVE-2020-0202 | High | 7.8 | 2020-06-11 | In onHandleIntent of TraceService.java, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission c… |
CVE-2020-0178 | Medium | 5.5 | 2020-06-11 | In getAllConfigFlags of SettingsProvider.cpp, there is a possible illegal read due to a missing permission check. This could lead to local information disclosu… |
CVE-2020-0177 | Medium | 5.5 | 2020-06-11 | In connect() of PanService.java, there is a possible permissions bypass. This could lead to local escalation of privilege to change network connection settings… |
CVE-2020-0137 | High | 7.8 | 2020-06-11 | In setIPv6AddrGenMode of NetworkManagementService.java, there is a possible bypass of networking permissions due to a missing permission check. This could lead… |
CVE-2020-0135 | Medium | 4.4 | 2020-06-11 | In dump of RollbackManagerServiceImpl.java, there is a possible backup metadata exposure due to a missing permission check. This could lead to local informatio… |
CVE-2020-5362 | High | 7.1 | 2020-06-10 | Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized act… |
CVE-2020-13445 | High | 8.8 | 2020-06-10 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict us… |
CVE-2020-13270 | High | 7.5 | 2020-06-10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted pub… |
CVE-2020-6270 | Medium | 6.5 | 2020-06-10 | SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for… |
CVE-2020-6268 | High | 8.1 | 2020-06-10 | Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 10… |
CVE-2020-13266 | Medium | 4.3 | 2020-06-09 | Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys unde… |
CVE-2020-11680 | Medium | 6.5 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted… |
CVE-2020-11679 | High | 8.8 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fail… |
CVE-2020-1963 | Critical | 9.1 | 2020-06-03 | Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem. |
CVE-2020-4348 | Medium | 6.5 | 2020-05-27 | IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing fu… |
CVE-2020-13425 | High | 7.1 | 2020-05-23 | TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a denial of service when battery capacit… |
CVE-2020-13154 | Medium | 6.5 | 2020-05-18 | Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectio… |
CVE-2020-13144 | High | 8.8 | 2020-05-18 | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component… |
CVE-2019-20801 | Medium | 5.3 | 2020-05-18 | An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any… |
CVE-2020-10620 | Critical | 9.8 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly… |
CVE-2020-10612 | Critical | 9.1 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any re… |
CVE-2020-0109 | High | 7.8 | 2020-05-14 | In simulatePackageSuspendBroadcast of NotificationManagerService.java, there is a missing permission check. This could lead to local escalation of privilege by… |
CVE-2020-0106 | Medium | 5.5 | 2020-05-14 | In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version check. This could lead to local informatio… |