CWE-862 · Missing Authorization (page 89)
Page 89 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12734 | High | 8.8 | 2019-12-06 | SiteVision 4 has Incorrect Access Control. |
CVE-2019-15998 | Medium | 5.3 | 2019-11-26 | A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control lis… |
CVE-2019-5865 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2019-13673 | High | 7.4 | 2019-11-25 | Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2019-14822 | High | 7.1 | 2019-11-25 | A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due… |
CVE-2019-18610 | High | 8.8 | 2019-11-22 | An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Aste… |
CVE-2019-18790 | Medium | 6.5 | 2019-11-22 | An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.2… |
CVE-2019-16547 | Medium | 4.3 | 2019-11-21 | Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to ob… |
CVE-2019-15387 | Low | 3.3 | 2019-11-14 | The Archos Core 101 Android device with a build fingerprint of archos/MTKAC101CR3G_ARCHOS/ac101cr3g:7.0/NRD90M/20180611.034442:user/release-keys contains a pre… |
CVE-2019-15386 | Medium | 5.5 | 2019-11-14 | The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package n… |
CVE-2019-0386 | Medium | 6.3 | 2019-11-13 | Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01… |
CVE-2019-15005 | Medium | 4.3 | 2019-11-08 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results… |
CVE-2019-6121 | Low | 3.7 | 2019-11-06 | An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as h… |
CVE-2019-18674 | Medium | 5.3 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. |
CVE-2019-16909 | Medium | 4.3 | 2019-11-01 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (… |
CVE-2019-16907 | Medium | 5.3 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames w… |
CVE-2019-16906 | High | 7.5 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with… |
CVE-2019-13547 | Critical | 9.8 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without… |
CVE-2019-5095 | Medium | 4.3 | 2019-10-31 | An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for iss… |
CVE-2019-18383 | High | 7.5 | 2019-10-23 | An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramaster_TNAS-00E43A_config_backup.bin without per… |
CVE-2019-15850 | High | 8.8 | 2019-10-17 | eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and c… |
CVE-2019-16698 | Medium | 4.3 | 2019-10-16 | The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissi… |
CVE-2019-10457 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacke… |
CVE-2019-10455 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-speci… |
CVE-2019-10445 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited inform… |
CVE-2019-10442 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2019-10439 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Ov… |
CVE-2019-10438 | Medium | 6.5 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an att… |
CVE-2019-12944 | High | 7.5 | 2019-10-15 | Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable. |
CVE-2019-2110 | Medium | 5.5 | 2019-10-11 | In ScreenRotationAnimation of ScreenRotationAnimation.java, there is a possible capture of a secure screen due to a missing permission check. This could lead t… |
CVE-2019-0367 | Medium | 4.3 | 2019-10-08 | SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowi… |
CVE-2019-17055 | Low | 3.3 | 2019-10-01 | base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that… |
CVE-2019-9380 | Medium | 6.5 | 2019-09-27 | In the settings UI, there is a possible spoofing vulnerability due to a missing permission check. This could lead to a user mistakenly changing permission sett… |
CVE-2019-9377 | Low | 3.3 | 2019-09-27 | In FingerprintService, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check… |
CVE-2019-9351 | Low | 3.3 | 2019-09-27 | In SyncStatusObserver, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check… |
CVE-2019-9323 | Medium | 5.3 | 2019-09-27 | In the Wallpaper Manager service, there is a possible information disclosure due to a missing permission check. Any application can access wallpaper image with… |
CVE-2019-9295 | High | 7.8 | 2019-09-27 | In com.android.apps.tag, there is a possible bypass of user interaction requirements due to a missing permission check. This could lead to a to local escalatio… |
CVE-2019-9263 | High | 7.8 | 2019-09-27 | In telephony, there is a possible bypass of user interaction requirements due to missing permission checks. This could lead to local escalation of privilege wi… |
CVE-2019-16738 | Medium | 5.3 | 2019-09-26 | In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. |
CVE-2019-10409 | Medium | 4.3 | 2019-09-25 | A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation… |
CVE-2019-15723 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass p… |
CVE-2019-15030 | Medium | 4.4 | 2019-09-13 | In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable excepti… |
CVE-2019-16236 | High | 7.5 | 2019-09-11 | Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. |
CVE-2019-14995 | Medium | 5.3 | 2019-09-11 | The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and… |
CVE-2019-12942 | Medium | 6.5 | 2019-09-10 | TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable. |
CVE-2019-5463 | Medium | 5.3 | 2019-09-09 | An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was… |
CVE-2019-16124 | Critical | 9.8 | 2019-09-09 | In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert… |
CVE-2019-16097 | Medium | 6.5 | 2019-09-08 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as aut… |
CVE-2019-15954 | Critical | 9.9 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote… |
CVE-2019-15953 | High | 8.8 | 2019-09-05 | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the… |
CVE-2019-15871 | Medium | 4.3 | 2019-09-03 | The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings. |
CVE-2019-13408 | High | 7.5 | 2019-08-29 | A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportS… |
CVE-2019-11248 | High | 8.2 | 2019-08-29 | The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port… |
CVE-2019-15648 | Medium | 6.5 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. |
CVE-2019-13013 | Medium | 5.5 | 2019-08-23 | Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an… |
CVE-2019-8445 | Medium | 5.3 | 2019-08-23 | Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time informati… |
CVE-2019-2137 | Medium | 5.5 | 2019-08-20 | In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of a… |
CVE-2019-15136 | High | 7.5 | 2019-08-18 | The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to polic… |
CVE-2019-14786 | Medium | 6.5 | 2019-08-15 | The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter. |
CVE-2019-1170 | High | 7.9 | 2019-08-14 | An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exp… |
CVE-2019-0349 | High | 7.2 | 2019-08-14 | SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.4… |
CVE-2019-14793 | Medium | 6.5 | 2019-08-09 | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. |
CVE-2019-10389 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connecti… |
CVE-2019-10387 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read acces… |
CVE-2019-10377 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins. |
CVE-2019-10369 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTes… |
CVE-2019-5995 | Medium | 6.5 | 2019-08-06 | Missing authorization vulnerability exists in EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and… |
CVE-2019-14473 | High | 8.8 | 2019-08-06 | eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can crea… |
CVE-2019-14475 | High | 7.5 | 2019-08-05 | eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a ses… |
CVE-2019-14544 | Critical | 9.8 | 2019-08-02 | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10187 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other… |
CVE-2019-10357 | Medium | 4.3 | 2019-07-31 | A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited inform… |
CVE-2019-10344 | Medium | 4.3 | 2019-07-31 | Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access t… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-5449 | Medium | 4.3 | 2019-07-30 | A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. |
CVE-2019-10184 | High | 7.5 | 2019-07-25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests withou… |
CVE-2019-11702 | Medium | 6.5 | 2019-07-23 | A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if… |
CVE-2019-11700 | Medium | 6.5 | 2019-07-23 | A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note… |
CVE-2019-1010152 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80. |
CVE-2019-1010150 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php. |
CVE-2019-1010149 | Critical | 9.8 | 2019-07-23 | zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence… |
CVE-2019-1010246 | High | 7.5 | 2019-07-18 | MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQ… |
CVE-2019-1010066 | High | 7.5 | 2019-07-18 | Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registe… |
CVE-2019-10354 | Medium | 4.3 | 2019-07-17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, by… |
CVE-2019-1010304 | Medium | 5.3 | 2019-07-15 | Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorr… |
CVE-2019-10342 | Medium | 4.3 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enu… |
CVE-2019-10341 | Medium | 6.5 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to co… |
CVE-2019-0325 | Medium | 4.2 | 2019-07-10 | SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due t… |
CVE-2019-12470 | Medium | 6.5 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12469 | Medium | 6.5 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-13450 | Medium | 6.5 | 2019-07-09 | In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active… |
CVE-2019-12926 | High | 8.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of act… |
CVE-2019-2117 | Medium | 5.5 | 2019-07-08 | In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check. This could lead to local in… |
CVE-2019-7272 | Medium | 5.3 | 2019-07-01 | Optergy Proton/Enterprise devices allow Username Disclosure. |
CVE-2019-13047 | High | 7.8 | 2019-06-29 | kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys_sysfunc case 9 for TOARU_SYS_FUNC_SETHEAP, allowing arbitrary kernel pages t… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2019-4158 | Medium | 5.4 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality t… |
CVE-2019-6961 | Medium | 6.5 | 2019-06-20 | Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other privi… |
CVE-2019-2005 | High | 8.8 | 2019-06-19 | In onPermissionGrantResult of GrantPermissionsActivity.java, there is a possible incorrectly granted permission due to a missing permission check. This could l… |