CWE-862 · Missing Authorization (page 88)
Page 88 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0105 | High | 7.8 | 2020-05-14 | In onKeyguardVisibilityChanged of key_store_service.cpp, there is a missing permission check. This could lead to local escalation of privilege, allowing apps t… |
CVE-2020-1996 | Medium | 5.3 | 2020-05-13 | A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the ma… |
CVE-2020-12700 | Medium | 4.3 | 2020-05-13 | The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query. |
CVE-2020-12698 | Medium | 4.3 | 2020-05-13 | The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables. |
CVE-2020-6259 | Medium | 6.5 | 2020-05-12 | Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted lead… |
CVE-2020-6258 | Medium | 6.5 | 2020-05-12 | SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitiv… |
CVE-2020-6256 | Medium | 4.3 | 2020-05-12 | SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required… |
CVE-2020-12745 | High | 7.5 | 2020-05-11 | An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protection mechanism and access clipboard conten… |
CVE-2020-11671 | High | 8.1 | 2020-05-04 | Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass adminis… |
CVE-2020-10187 | High | 7.5 | 2020-05-04 | Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the… |
CVE-2019-15877 | Medium | 5.5 | 2020-04-28 | In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check… |
CVE-2019-15876 | Medium | 5.5 | 2020-04-28 | In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specifi… |
CVE-2020-12138 | High | 8.8 | 2020-04-27 | AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical… |
CVE-2020-6212 | Medium | 5.4 | 2020-04-24 | Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA… |
CVE-2020-6823 | Critical | 9.8 | 2020-04-24 | A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain… |
CVE-2020-11967 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The ven… |
CVE-2019-14116 | High | 7.8 | 2020-04-16 | Privilege escalation by using an altered debug policy image can occur as the XPU protecting the debug policy regions are disabled during the crash dump boot fl… |
CVE-2019-20676 | Medium | 6.0 | 2020-04-15 | Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE b… |
CVE-2020-7278 | High | 7.4 | 2020-04-15 | Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Ap… |
CVE-2020-6233 | Medium | 4.3 | 2020-04-14 | SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analys… |
CVE-2020-6232 | Medium | 5.3 | 2020-04-14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects conf… |
CVE-2018-21047 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is a Factory Reset Protection (FRP) bypass via the voice assistant because Intern… |
CVE-2018-21046 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is clipboard Data Exposure via the Emergency Dialer upon connecting a USB device… |
CVE-2018-21042 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Dual Messenger allows installation of an arbitrary APK with resulta… |
CVE-2020-9514 | Medium | 6.5 | 2020-04-07 | An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to per… |
CVE-2020-11514 | Critical | 9.8 | 2020-04-07 | The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to es… |
CVE-2017-18677 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Because of an unprotected Intent, an attacker can reset the configuration of… |
CVE-2017-18666 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Applications can send arbitrary premium SMS messages… |
CVE-2016-11036 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (Augu… |
CVE-2020-10689 | Medium | 6.4 | 2020-04-03 | A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this fl… |
CVE-2020-11465 | High | 8.8 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/i… |
CVE-2020-11463 | High | 7.5 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to re… |
CVE-2020-10955 | Medium | 6.5 | 2020-03-27 | GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under speci… |
CVE-2019-20614 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Allshare allows attackers to access sensitive information. The Sams… |
CVE-2019-20609 | Medium | 6.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch to view Secure Folder notification content. The Samsung ID… |
CVE-2019-20599 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Voice Assistant mishandles the notification audibility of a secured… |
CVE-2019-20555 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) software. The Gallery app allows attackers to view all pictures of a locked device. The Samsung I… |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2020-8139 | Medium | 6.5 | 2020-03-20 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to… |
CVE-2020-10194 | Medium | 6.5 | 2020-03-20 | cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the inte… |
CVE-2019-12498 | Critical | 9.8 | 2020-03-20 | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism. |
CVE-2019-18581 | High | 7.2 | 2020-03-18 | Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authoriz… |
CVE-2019-14883 | Medium | 5.3 | 2020-03-18 | A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disable… |
CVE-2020-1720 | Low | 3.1 | 2020-03-17 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use… |
CVE-2020-10116 | Medium | 5.3 | 2020-03-17 | cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). |
CVE-2019-20407 | Medium | 4.3 | 2020-03-17 | The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release v… |
CVE-2019-19937 | High | 7.2 | 2020-03-16 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "un… |
CVE-2018-13063 | High | 7.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2020-6204 | Medium | 4.3 | 2020-03-10 | The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE ve… |
CVE-2020-6199 | Medium | 5.4 | 2020-03-10 | The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Managemen… |
CVE-2020-0085 | High | 7.8 | 2020-03-10 | In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0084 | High | 7.8 | 2020-03-10 | In several functions of NotificationManagerService.java, there are missing permission checks. This could lead to local escalation of privilege by creating fake… |
CVE-2020-0054 | High | 7.8 | 2020-03-10 | In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permission check. This could… |
CVE-2020-0047 | Low | 3.3 | 2020-03-10 | In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio with no additional execution privileges… |
CVE-2020-0035 | Medium | 5.5 | 2020-03-10 | In query of TelephonyProvider.java, there is a possible access to SIM card info due to a missing permission check. This could lead to local information disclos… |
CVE-2020-10257 | Critical | 9.8 | 2020-03-10 | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functio… |
CVE-2020-2142 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds. |
CVE-2020-9458 | High | 8.8 | 2020-03-06 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submit… |
CVE-2020-9457 | High | 8.8 | 2020-03-06 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and ch… |
CVE-2020-9456 | High | 8.8 | 2020-03-06 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their… |
CVE-2020-9455 | Medium | 4.3 | 2020-03-06 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of th… |
CVE-2019-19989 | High | 7.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user witho… |
CVE-2012-0055 | High | 7.8 | 2020-02-19 | OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypas… |
CVE-2012-6614 | High | 7.2 | 2020-02-19 | D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting… |
CVE-2013-4226 | Medium | 6.5 | 2020-02-18 | The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote… |
CVE-2020-0023 | Medium | 5.5 | 2020-02-13 | In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This… |
CVE-2020-6188 | High | 8.8 | 2020-02-12 | VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 1… |
CVE-2020-6183 | Medium | 6.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL proce… |
CVE-2020-6393 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-8811 | Medium | 4.3 | 2020-02-07 | ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. |
CVE-2020-8772 | Critical | 9.8 | 2020-02-06 | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the user… |
CVE-2020-7968 | High | 7.5 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. |
CVE-2020-7993 | Medium | 4.3 | 2020-02-03 | Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field. |
CVE-2020-8495 | High | 7.5 | 2020-01-30 | In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeepe… |
CVE-2020-5228 | High | 7.6 | 2020-01-30 | Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is… |
CVE-2019-5470 | High | 7.5 | 2020-01-28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of… |
CVE-2013-3960 | Critical | 9.9 | 2020-01-24 | Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass |
CVE-2019-19802 | Medium | 6.5 | 2020-01-17 | In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2)… |
CVE-2020-2094 | Medium | 4.3 | 2020-01-15 | A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to… |
CVE-2020-2091 | High | 8.1 | 2020-01-15 | A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2020-6306 | Low | 2.7 | 2020-01-14 | Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
CVE-2020-6168 | High | 7.6 | 2020-01-09 | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable mainten… |
CVE-2019-11761 | Medium | 5.4 | 2020-01-08 | By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this o… |
CVE-2018-19830 | High | 7.5 | 2019-12-31 | The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers… |
CVE-2018-20501 | Medium | 6.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-19985 | Medium | 5.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. |
CVE-2019-19899 | Critical | 9.8 | 2019-12-19 | Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessi… |
CVE-2019-15576 | High | 7.5 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a G… |
CVE-2019-15013 | Medium | 4.3 | 2019-12-18 | The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8… |
CVE-2019-16576 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2019-16574 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2019-16571 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2019-16567 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credent… |
CVE-2019-16566 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2019-15932 | Critical | 9.8 | 2019-12-12 | Intesync Solismed 3.3sp has Incorrect Access Control. |
CVE-2019-19604 | High | 7.8 | 2019-12-11 | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 becaus… |
CVE-2019-13748 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information… |
CVE-2019-2229 | Medium | 5.5 | 2019-12-06 | In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. This could lead to local information discl… |
CVE-2019-2218 | High | 7.8 | 2019-12-06 | In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to l… |