CWE-862
8,707 CVEs • Abstraction: Class • Likelihood of Exploit: High
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVEs (8,707)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. |
In contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with no additional execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. |
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. |
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. |
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed. |
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any...Show more |
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&...Show more |
1Mozilla 3Firefox Firefox EsrThunderbirdJun 17, 2026 Dec 22, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This...Show more |
1Popup Manager Project 1Popup Manager Jun 17, 2026 Dec 19, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them |
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their p...Show more |
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. |