Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVEs (8,727)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-21248 1Google 1Android Jun 17, 2026 Jul 13, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privile...Show more In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Show less
CVE-2023-21247 1Google 1Android Jun 17, 2026 Jul 13, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of pr...Show more In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Show less
CVE-2023-37965 1Jenkins 1Elasticbox Ci Jun 17, 2026 Jul 12, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through...Show more A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-37963 1Jenkins 1Benchmark Evaluator Jun 17, 2026 Jul 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.cs...Show more A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.Show less
CVE-2023-37959 1Jenkins 1Sumologic Publisher Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2023-37956 1Jenkins 1Test Results Aggregator Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2023-37953 1Jenkins 1Mabl Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another...Show more A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-37950 1Jenkins 1Mabl Jun 17, 2026 Jul 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-37949 1Jenkins 1Orka By Macstadium Jun 17, 2026 Jul 12, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained thr...Show more A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-37945 1Jenkins 1Saml Single Sign On Jun 17, 2026 Jul 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to download a string representation of the current security realm.
CVE-2023-37944 1Jenkins 1Datadog Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth...Show more A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-33902 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33901 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33900 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33899 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33898 1Unisoc 13S8000 Sc7731eSc9832e+10 more Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33895 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33894 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33893 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-33892 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In fastDial service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

Previous 1...344345346...437 Next