CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (5,392)
page 261 of 270| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-0611 | 0.00 | — | 0.00 | Feb 15, 2022 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. | |||
| CVE-2022-25211 | — | 0.00 | — | 0.00 | Feb 15, 2022 | A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials. | ||
| CVE-2022-25208 | 0.00 | — | 0.00 | Feb 15, 2022 | A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response. | |||
| CVE-2022-25206 | 0.00 | — | 0.00 | Feb 15, 2022 | A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials. | |||
| CVE-2022-25201 | 0.00 | — | 0.00 | Feb 15, 2022 | Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||
| CVE-2022-25199 | 0.00 | — | 0.00 | Feb 15, 2022 | A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials. | |||
| CVE-2022-25195 | — | 0.00 | — | 0.00 | Feb 15, 2022 | A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. | ||
| CVE-2022-25193 | — | 0.00 | — | 0.00 | Feb 15, 2022 | Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in… | ||
| CVE-2022-25190 | 0.00 | — | 0.00 | Feb 15, 2022 | A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||
| CVE-2022-0588 | 0.00 | — | 0.00 | Feb 15, 2022 | Missing Authorization in Packagist librenms/librenms prior to 22.2.0. | |||
| CVE-2022-0579 | 0.00 | — | 0.00 | Feb 14, 2022 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. | |||
| CVE-2022-23621 | 0.00 | — | 0.00 | Feb 9, 2022 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through… | |||
| CVE-2022-23617 | 0.00 | — | 0.00 | Feb 9, 2022 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in… | |||
| CVE-2022-0203 | 0.00 | — | 0.00 | Jan 26, 2022 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. | |||
| CVE-2022-23945 | 0.00 | — | 0.01 | Jan 25, 2022 | Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. | |||
| CVE-2022-0178 | 0.00 | — | 0.00 | Jan 13, 2022 | Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8. | |||
| CVE-2022-23112 | 0.00 | — | 0.00 | Jan 12, 2022 | A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials. | |||
| CVE-2022-20620 | 0.00 | — | 0.00 | Jan 12, 2022 | Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. | |||
| CVE-2022-20618 | 0.00 | — | 0.00 | Jan 12, 2022 | A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. | |||
| CVE-2022-20616 | 0.00 | — | 0.00 | Jan 12, 2022 | Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. |
- CVE-2022-0611Feb 15, 2022risk 0.00cvss —epss 0.00
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
- CVE-2022-25211Feb 15, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials.
- CVE-2022-25208Feb 15, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
- CVE-2022-25206Feb 15, 2022risk 0.00cvss —epss 0.00
A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
- CVE-2022-25201Feb 15, 2022risk 0.00cvss —epss 0.00
Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- CVE-2022-25199Feb 15, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
- CVE-2022-25195Feb 15, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
- CVE-2022-25193Feb 15, 2022risk 0.00cvss —epss 0.00
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in…
- CVE-2022-25190Feb 15, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- CVE-2022-0588Feb 15, 2022risk 0.00cvss —epss 0.00
Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
- CVE-2022-0579Feb 14, 2022risk 0.00cvss —epss 0.00
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
- CVE-2022-23621Feb 9, 2022risk 0.00cvss —epss 0.00
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through…
- CVE-2022-23617Feb 9, 2022risk 0.00cvss —epss 0.00
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in…
- CVE-2022-0203Jan 26, 2022risk 0.00cvss —epss 0.00
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
- CVE-2022-23945Jan 25, 2022risk 0.00cvss —epss 0.01
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
- CVE-2022-0178Jan 13, 2022risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.
- CVE-2022-23112Jan 12, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.
- CVE-2022-20620Jan 12, 2022risk 0.00cvss —epss 0.00
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
- CVE-2022-20618Jan 12, 2022risk 0.00cvss —epss 0.00
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
- CVE-2022-20616Jan 12, 2022risk 0.00cvss —epss 0.00
Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.