CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,032)
page 167 of 502| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-36512 | Med | 0.42 | 6.5 | 0.00 | Jun 19, 2024 | Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5. | ||
| CVE-2024-5768 | Med | 0.42 | 6.4 | 0.00 | Jun 19, 2024 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_update_provider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers,… | ||
| CVE-2024-1634 | Med | 0.42 | 6.5 | 0.00 | Jun 18, 2024 | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for… | ||
| CVE-2024-5685 | Hig | 0.42 | 7.6 | 0.00 | Jun 14, 2024 | Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1. | ||
| CVE-2023-51495 | Med | 0.42 | 6.5 | 0.00 | Jun 14, 2024 | Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7. | ||
| CVE-2023-36504 | Med | 0.42 | 6.5 | 0.00 | Jun 14, 2024 | Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5. | ||
| CVE-2023-29174 | Med | 0.42 | 6.5 | 0.00 | Jun 14, 2024 | Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0. | ||
| CVE-2024-5674 | Med | 0.42 | 6.5 | 0.00 | Jun 12, 2024 | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list,… | ||
| CVE-2023-40209 | Med | 0.42 | 6.5 | 0.00 | Jun 12, 2024 | Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0. | ||
| CVE-2024-5468 | Med | 0.42 | 6.5 | 0.00 | Jun 12, 2024 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for… | ||
| CVE-2024-34799 | Med | 0.42 | 6.5 | 0.00 | Jun 11, 2024 | Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82. | ||
| CVE-2024-34820 | Med | 0.42 | 6.5 | 0.00 | Jun 11, 2024 | Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1. | ||
| CVE-2024-35716 | Med | 0.42 | 6.5 | 0.00 | Jun 11, 2024 | Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9. | ||
| CVE-2024-34691 | Med | 0.42 | 6.5 | 0.00 | Jun 11, 2024 | Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system. | ||
| CVE-2024-31284 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8. | ||
| CVE-2024-32805 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in Social Snap.This issue affects Social Snap: from n/a through 1.3.5. | ||
| CVE-2024-35660 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1. | ||
| CVE-2024-30470 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0. | ||
| CVE-2024-30467 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9. | ||
| CVE-2024-30465 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2024 | Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1. |
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5.
- risk 0.42cvss 6.4epss 0.00
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_update_provider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers,…
- risk 0.42cvss 6.5epss 0.00
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for…
- risk 0.42cvss 7.6epss 0.00
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0.
- risk 0.42cvss 6.5epss 0.00
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list,…
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
- risk 0.42cvss 6.5epss 0.00
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for…
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9.
- risk 0.42cvss 6.5epss 0.00
Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Social Snap.This issue affects Social Snap: from n/a through 1.3.5.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.