CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (5,392)
page 252 of 270| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-37910 | 0.00 | — | 0.01 | Oct 25, 2023 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any… | |||
| CVE-2023-46652 | 0.00 | — | 0.00 | Oct 25, 2023 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins. | |||
| CVE-2023-43501 | 0.00 | — | 0.00 | Sep 20, 2023 | A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. | |||
| CVE-2023-41947 | 0.00 | — | 0.00 | Sep 6, 2023 | A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials. | |||
| CVE-2023-41945 | 0.00 | — | 0.00 | Sep 6, 2023 | Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. | |||
| CVE-2023-41943 | 0.00 | — | 0.00 | Sep 6, 2023 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. | |||
| CVE-2023-41941 | 0.00 | — | 0.00 | Sep 6, 2023 | A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins. | |||
| CVE-2023-41046 | 0.00 | — | 0.00 | Sep 1, 2023 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or… | |||
| CVE-2023-4302 | 0.00 | — | 0.00 | Aug 21, 2023 | A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||
| CVE-2023-40344 | 0.00 | — | 0.00 | Aug 16, 2023 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||
| CVE-2023-40027 | 0.00 | — | 0.00 | Aug 15, 2023 | Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI… | |||
| CVE-2023-4106 | 0.00 | — | 0.00 | Aug 11, 2023 | Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks. | |||
| CVE-2023-4105 | 0.00 | — | 0.00 | Aug 11, 2023 | Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message | |||
| CVE-2023-4304 | 0.00 | — | 0.00 | Aug 11, 2023 | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. | |||
| CVE-2023-39966 | 0.00 | — | 0.00 | Aug 10, 2023 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data… | |||
| CVE-2023-4124 | — | 0.00 | — | 0.00 | Aug 3, 2023 | Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1. | ||
| CVE-2023-3426 | 0.00 | — | 0.00 | Aug 2, 2023 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. | |||
| CVE-2023-3442 | — | 0.00 | — | 0.00 | Jul 26, 2023 | A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins… | ||
| CVE-2023-3300 | 0.00 | — | 0.01 | Jul 19, 2023 | HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1. | |||
| CVE-2023-3072 | 0.00 | — | 0.00 | Jul 19, 2023 | HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. |
- CVE-2023-37910Oct 25, 2023risk 0.00cvss —epss 0.01
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit access on any…
- CVE-2023-46652Oct 25, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins.
- CVE-2023-43501Sep 20, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
- CVE-2023-41947Sep 6, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.
- CVE-2023-41945Sep 6, 2023risk 0.00cvss —epss 0.00
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.
- CVE-2023-41943Sep 6, 2023risk 0.00cvss —epss 0.00
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
- CVE-2023-41941Sep 6, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
- CVE-2023-41046Sep 1, 2023risk 0.00cvss —epss 0.00
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or…
- CVE-2023-4302Aug 21, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- CVE-2023-40344Aug 16, 2023risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- CVE-2023-40027Aug 15, 2023risk 0.00cvss —epss 0.00
Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI…
- CVE-2023-4106Aug 11, 2023risk 0.00cvss —epss 0.00
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
- CVE-2023-4105Aug 11, 2023risk 0.00cvss —epss 0.00
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message
- CVE-2023-4304Aug 11, 2023risk 0.00cvss —epss 0.00
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
- CVE-2023-39966Aug 10, 2023risk 0.00cvss —epss 0.00
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data…
- CVE-2023-4124Aug 3, 2023risk 0.00cvss —epss 0.00
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
- CVE-2023-3426Aug 2, 2023risk 0.00cvss —epss 0.00
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
- CVE-2023-3442Jul 26, 2023risk 0.00cvss —epss 0.00
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins…
- CVE-2023-3300Jul 19, 2023risk 0.00cvss —epss 0.01
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
- CVE-2023-3072Jul 19, 2023risk 0.00cvss —epss 0.00
HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.