Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

CVEs (23)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-24501 1Amentotech 1Workreap Jun 17, 2026 Aug 9, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a lo...Show more The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.Show less
CVE-2021-24500 1Amentotech 1Workreap Jun 17, 2026 Aug 9, 2021 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logge...Show more Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.Show less
CVE-2020-8554 2Kubernetes Oracle 4Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core PolicyCommunications Cloud Native Core Service Communication Proxy+1 more Jun 17, 2026 Jan 21, 2021 N/A· v4 5.0 MEDIUM· v3 6.0 MEDIUM· v2 Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patc...Show more Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.Show less

Previous 12