CWE-862 · Missing Authorization (page 90)
Page 90 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12875 | Medium | 6.5 | 2019-06-18 | Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance… |
CVE-2019-6580 | Critical | 9.8 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-10339 | High | 8.8 | 2019-06-11 | A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read acce… |
CVE-2019-10333 | Medium | 4.3 | 2019-06-11 | Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain informati… |
CVE-2019-10332 | Medium | 4.3 | 2019-06-11 | A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect… |
CVE-2019-2098 | High | 7.8 | 2019-06-07 | In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could… |
CVE-2019-2092 | High | 7.8 | 2019-06-07 | In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could l… |
CVE-2019-2091 | High | 7.8 | 2019-06-07 | In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This… |
CVE-2019-2090 | High | 7.8 | 2019-06-07 | In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could lead to l… |
CVE-2019-12274 | High | 8.8 | 2019-06-06 | In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver opt… |
CVE-2019-10147 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups du… |
CVE-2019-10145 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering… |
CVE-2019-10330 | High | 7.5 | 2019-05-31 | Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles eve… |
CVE-2019-10323 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access t… |
CVE-2019-10322 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Rea… |
CVE-2019-11875 | High | 8.8 | 2019-05-24 | In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vuln… |
CVE-2019-10849 | High | 7.5 | 2019-05-23 | Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. |
CVE-2019-0201 | Medium | 5.9 | 2019-05-23 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves… |
CVE-2019-10319 | Medium | 4.3 | 2019-05-21 | A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Over… |
CVE-2019-12168 | High | 7.2 | 2019-05-17 | Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. |
CVE-2019-6790 | Medium | 4.3 | 2019-05-17 | An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6… |
CVE-2019-0293 | Medium | 6.5 | 2019-05-14 | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations… |
CVE-2019-0280 | High | 8.8 | 2019-05-14 | SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary aut… |
CVE-2019-11611 | High | 7.5 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerabilit… |
CVE-2019-11610 | High | 7.5 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php. A remote unauthenticated attacker can exploit this vulnerabi… |
CVE-2019-11609 | High | 8.2 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php. A remote unauthenticated attacker can exploit this vulnerabilit… |
CVE-2019-11608 | High | 8.2 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php. A remote unauthenticated attacker can exploit this vulnerabil… |
CVE-2019-11607 | High | 7.5 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php. A remote unauthenticated attacker can exploit this vulnerability… |
CVE-2019-11606 | High | 7.5 | 2019-04-30 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php. A remote unauthenticated attacker can exploit this vulnerabilit… |
CVE-2019-3399 | High | 7.5 | 2019-04-30 | The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for arch… |
CVE-2019-10312 | Medium | 4.3 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems… |
CVE-2019-10311 | High | 8.8 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form va… |
CVE-2019-10308 | Medium | 6.5 | 2019-04-30 | A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed… |
CVE-2018-14997 | Medium | 5.5 | 2019-04-25 | The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains the android frame… |
CVE-2019-2026 | High | 7.8 | 2019-04-19 | In updateAssistMenuItems of Editor.java, there is a possible escape from the Setup Wizard due to a missing permission check. This could lead to local escalatio… |
CVE-2019-10305 | Medium | 6.5 | 2019-04-18 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Over… |
CVE-2019-10301 | High | 8.8 | 2019-04-18 | A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers… |
CVE-2019-9224 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9171 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9974 | Critical | 9.1 | 2019-04-11 | diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET… |
CVE-2019-0279 | High | 8.8 | 2019-04-10 | ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.1… |
CVE-2019-10868 | Medium | 6.5 | 2019-04-05 | In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated u… |
CVE-2019-3886 | Medium | 5.4 | 2019-04-04 | An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, whic… |
CVE-2019-10293 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to… |
CVE-2019-10290 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method all… |
CVE-2019-10279 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overa… |
CVE-2019-1003099 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overal… |
CVE-2019-1003093 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read… |
CVE-2019-1003091 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Ove… |
CVE-2019-1003087 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attacke… |
CVE-2019-1003085 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers wi… |
CVE-2019-1003083 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read perm… |
CVE-2019-1003081 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows… |
CVE-2019-1003079 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attacker… |
CVE-2019-1003077 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attacke… |
CVE-2019-1003059 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission… |
CVE-2019-10648 | Critical | 9.8 | 2019-03-30 | Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an… |
CVE-2019-1003047 | Medium | 6.5 | 2019-03-28 | A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connecti… |
CVE-2019-1003043 | High | 7.5 | 2019-03-28 | A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-3879 | High | 8.1 | 2019-03-25 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation… |
CVE-2019-3835 | Medium | 5.5 | 2019-03-25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use thi… |
CVE-2019-9924 | High | 7.8 | 2019-03-22 | rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of t… |
CVE-2018-4059 | Critical | 9.8 | 2019-03-21 | An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server ru… |
CVE-2018-17491 | High | 8.4 | 2019-03-21 | EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the program, an attacker… |
CVE-2018-17490 | High | 7.7 | 2019-03-21 | EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit this vulnerability to… |
CVE-2018-10093 | High | 8.8 | 2019-03-21 | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. |
CVE-2019-9742 | High | 7.5 | 2019-03-13 | gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OP… |
CVE-2019-0270 | High | 8.8 | 2019-03-12 | ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges… |
CVE-2019-9713 | High | 7.5 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access. |
CVE-2019-1003037 | Medium | 6.5 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java… |
CVE-2019-1003036 | Medium | 4.3 | 2019-03-08 | A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java tha… |
CVE-2019-1003035 | Medium | 4.3 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTempl… |
CVE-2019-9574 | High | 7.5 | 2019-03-05 | The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR M… |
CVE-2019-9482 | Medium | 5.3 | 2019-03-01 | In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received… |
CVE-2019-9002 | Critical | 9.8 | 2019-02-22 | An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code vi… |
CVE-2019-1003025 | High | 8.8 | 2019-02-20 | A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allo… |
CVE-2019-5779 | Medium | 4.3 | 2019-02-19 | Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2019-5774 | High | 8.8 | 2019-02-19 | Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who conv… |
CVE-2019-0258 | High | 8.8 | 2019-02-15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2019-0257 | High | 8.8 | 2019-02-15 | Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7… |
CVE-2018-11888 | High | 7.8 | 2019-02-11 | Unauthorized access may be allowed by the SCP11 Crypto Services TA will processing commands from other TA in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-1003006 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attac… |
CVE-2018-18996 | Critical | 9.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute re… |
CVE-2019-1000017 | Medium | 6.5 | 2019-02-04 | Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user… |
CVE-2017-6923 | Medium | 6.5 | 2019-01-22 | In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module d… |
CVE-2019-5886 | Critical | 9.8 | 2019-01-10 | An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows… |
CVE-2018-16081 | High | 7.4 | 2019-01-09 | Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install… |
CVE-2019-0573 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev… |
CVE-2019-0566 | High | 8.8 | 2019-01-08 | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This aff… |
CVE-2019-0555 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the b… |
CVE-2019-0243 | High | 8.8 | 2019-01-08 | Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an a… |
CVE-2018-2484 | High | 8.8 | 2019-01-08 | SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6… |
CVE-2018-18004 | Medium | 5.3 | 2019-01-03 | Incorrect Access Control in mod_inetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable ar… |
CVE-2018-15005 | High | 7.1 | 2018-12-28 | The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platfo… |
CVE-2018-14985 | High | 7.1 | 2018-12-28 | The Leagoo Z5C Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed… |
CVE-2018-15329 | High | 7.2 | 2018-12-20 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffi… |
CVE-2018-20155 | Medium | 4.3 | 2018-12-14 | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plu… |
CVE-2018-2503 | High | 7.4 | 2018-12-11 | By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in… |
CVE-2018-9548 | Medium | 5.5 | 2018-12-06 | In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation. This could lead to local information disc… |