CWE-862 <span class="text-2xl md:text-3xl font-bold ml-2" style="color:var(--text-secondary)">— Missing Authorization

CVE-2023-29174MEDIUMCVSS 6.5EG 6.5

Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.

2024-06-14

Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.

CVE-2023-29237MEDIUMCVSS 6.3EG 6.3

CVE-2023-29239MEDIUMCVSS 5.4EG 5.4

Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.

CVE-2023-29422MEDIUMCVSS 4.3EG 4.3

Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.

CVE-2023-29429MEDIUMCVSS 5.3EG 5.3

Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.

CVE-2023-29431MEDIUMCVSS 4.3EG 4.3

Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1.

CVE-2023-29433MEDIUMCVSS 5.4EG 5.4

Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.…

CVE-2023-2945MEDIUMCVSS 5.4EG 4.3

Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7.

2023-05-27

Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.

CVE-2023-29529MEDIUMCVSS 5.0EG 5.0

2023-04-14

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their …

CVE-2023-30195HIGHCVSS 7.5EG 7.5

2023-07-06

In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.

CVE-2023-30476MEDIUMCVSS 4.3EG 4.3

CVE-2023-30479MEDIUMCVSS 5.3EG 5.3

Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.

CVE-2023-30480MEDIUMCVSS 4.3EG 4.3

Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce:…

2024-03-25

Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5.

CVE-2023-30486MEDIUMCVSS 4.3EG 4.3

CVE-2023-30488MEDIUMCVSS 5.3EG 5.3

Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

CVE-2023-30490HIGHCVSS 7.5EG 7.5

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.

2024-12-13

Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.

CVE-2023-30518MEDIUMCVSS 4.3EG 4.3

CVE-2023-30519MEDIUMCVSS 5.3EG 5.3

A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVE-2023-30521MEDIUMCVSS 5.3EG 5.3

A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

CVE-2023-30522MEDIUMCVSS 4.3EG 4.3

A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

CVE-2023-30526MEDIUMCVSS 6.5EG 4.3

A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter.

CVE-2023-3053MEDIUMCVSS 5.4EG 5.4

A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.

2023-06-03

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authe…

CVE-2023-30532MEDIUMCVSS 6.5EG 6.5

CVE-2023-30581HIGHCVSS 7.5EG 7.5

A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.

2023-11-23

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all a…

CVE-2023-30586HIGHCVSS 7.5EG 7.5

2023-07-01

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high…

CVE-2023-3072MEDIUMCVSS 4.1EG 4.1

2023-07-20

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

CVE-2023-3076CRITICALCVSS 9.8EG 9.8

2023-07-10

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's …

CVE-2023-30783MEDIUMCVSS 4.3EG 4.3

CVE-2023-30863HIGHCVSS 7.8EG 7.8

Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.

CVE-2023-30864HIGHCVSS 7.8EG 7.8

In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2023-30865MEDIUMCVSS 5.5EG 5.5

In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2023-30866MEDIUMCVSS 5.5EG 5.5

In dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-30870MEDIUMCVSS 6.5EG 6.5

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-30873MEDIUMCVSS 5.4EG 5.4

Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship …

CVE-2023-30913MEDIUMCVSS 5.5EG 5.5

Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.

CVE-2023-30914MEDIUMCVSS 5.5EG 5.5

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-30915MEDIUMCVSS 5.5EG 5.5

In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-30916HIGHCVSS 7.8EG 7.8

In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-30917HIGHCVSS 7.8EG 7.8

In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2023-30918MEDIUMCVSS 5.5EG 5.5

In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2023-30919MEDIUMCVSS 5.5EG 5.5

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.