The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible…

CVE-2023-23611MEDIUMCVSS 5.4EG 5.4

2023-01-26

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is inte…

CVE-2023-23639MEDIUMCVSS 5.4EG 5.4

2024-06-09

Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3.

CVE-2023-23640MEDIUMCVSS 5.4EG 5.4

2024-06-09

Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.

CVE-2023-23672MEDIUMCVSS 5.4EG 5.4

2025-01-02

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

CVE-2023-23715MEDIUMCVSS 5.2EG 5.2

2024-12-09

Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submission…

CVE-2023-23716MEDIUMCVSS 4.3EG 4.3

2024-12-09

Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4.

CVE-2023-23725MEDIUMCVSS 4.3EG 4.3

2024-12-09

Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46.

CVE-2023-23729MEDIUMCVSS 5.4EG 5.4

2025-12-09

Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

CVE-2023-23763MEDIUMCVSS 5.3EG 5.3

2023-09-01

An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability …

CVE-2023-23814LOWCVSS 3.8EG 3.8

2024-12-09

Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13.

CVE-2023-23823MEDIUMCVSS 4.3EG 4.3

2024-12-09

Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8.

CVE-2023-23825LOWCVSS 3.1EG 3.1

2024-12-09

Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

CVE-2023-23834MEDIUMCVSS 4.3EG 4.3

2024-12-09

Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

CVE-2023-23848MEDIUMCVSS 4.3EG 4.3

2023-02-15

Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another …

CVE-2023-23850MEDIUMCVSS 4.3EG 4.3

2023-02-15

A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-23854LOWCVSS 3.8EG 5.4

2023-02-14

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

CVE-2023-23868MEDIUMCVSS 5.4EG 5.4

2024-12-09

Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.

CVE-2023-23882MEDIUMCVSS 4.3EG 4.3

2024-01-17

Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5.

CVE-2023-23886MEDIUMCVSS 5.4EG 5.4

2024-12-09

Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7.

CVE-2023-23887MEDIUMCVSS 5.3EG 5.3

2024-12-09

Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.

CVE-2023-23893MEDIUMCVSS 5.3EG 5.3

2024-12-09

Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0.

CVE-2023-23895MEDIUMCVSS 4.7EG 4.7

2024-12-09

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.

CVE-2023-23896MEDIUMCVSS 5.4EG 5.4

2024-01-17

Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.

CVE-2023-23975MEDIUMCVSS 5.3EG 5.3

2024-12-09

Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.

CVE-2023-23985LOWCVSS 3.7EG 3.7

2024-04-24

Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.

CVE-2023-23986MEDIUMCVSS 5.4EG 5.4

2024-12-09

Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Busine…

CVE-2023-23988HIGHCVSS 7.5EG 7.5

2024-05-17

Missing Authorization vulnerability in Joseph C Dolson My Tickets.This issue affects My Tickets: from n/a through 1.9.11.

CVE-2023-2414MEDIUMCVSS 5.4EG 5.4

2023-06-09

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and i…

CVE-2023-2415MEDIUMCVSS 5.4EG 5.4

2023-06-03

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and includin…

CVE-2023-2434LOWCVSS 3.8EG 3.8

2023-05-31

The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with ed…

CVE-2023-24375LOWCVSS 3.5EG 3.5

2024-12-09

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login an…

CVE-2023-24407MEDIUMCVSS 5.0EG 5.0

2024-12-09

Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a …

CVE-2023-24431MEDIUMCVSS 4.3EG 4.3

2023-01-26

A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-24433MEDIUMCVSS 6.5EG 6.5

2023-01-26

Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another …

CVE-2023-24435MEDIUMCVSS 6.5EG 6.5

2023-01-26

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through ano…

CVE-2023-24436MEDIUMCVSS 4.3EG 4.3

2023-01-26

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-24438MEDIUMCVSS 6.5EG 6.5

2023-01-26

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained thro…

CVE-2023-24448MEDIUMCVSS 6.5EG 6.5

2023-01-26

A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.

CVE-2023-24451MEDIUMCVSS 4.3EG 4.3

2023-01-26

A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-24453MEDIUMCVSS 6.5EG 6.5

2023-01-26

A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

CVE-2023-24459MEDIUMCVSS 6.5EG 6.5

2023-01-26

A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

CVE-2023-2448MEDIUMCVSS 6.5EG 6.5

2023-11-22

The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticate…

CVE-2023-24524MEDIUMCVSS 6.5EG 6.5

2023-02-14

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to av…

CVE-2023-24528MEDIUMCVSS 6.5EG 6.5

2023-02-14

SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over th…

CVE-2023-24605MEDIUMCVSS 4.2EG 4.2

2023-05-29

OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.

CVE-2023-24674HIGHCVSS 7.8EG 7.8

2023-09-01

Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.

CVE-2023-2480HIGHCVSS 7.5EG 7.5

2023-05-25

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

CVE-2023-2494MEDIUMCVSS 4.6EG 4.6

2023-05-24

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. Thi…

CVE-2023-25014HIGHCVSS 8.6EG 8.6

2023-02-02

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.

CWE-862— Missing Authorization

CVEs classified under CWE-862page 39 of 153

Map vulnerabilities like CWE-862 to your infrastructure