Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVEs (10,075)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-30925 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30924 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30923 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30922 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30921 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30920 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30919 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30918 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-30917 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2023-30916 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 In DMService, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2023-30913 1Google 1Android Jun 17, 2026 Jul 12, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2023-2869 1Butlerblog 1Wp Members Jun 17, 2026 Jul 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes...Show more The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.Show less
CVE-2023-2562 1Gallery Metabox Project 1Gallery Metabox Jun 17, 2026 Jul 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscribe...Show more The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.Show less
CVE-2023-2561 1Gallery Metabox Project 1Gallery Metabox Jun 17, 2026 Jul 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subs...Show more The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin.Show less
CVE-2023-33992 1Sap 2Business Warehouse Bw/4hana Jun 17, 2026 Jul 11, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell val...Show more The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level. Show less
CVE-2023-2078 1Buymeacoffee 1Buy Me A Coffee Jun 17, 2026 Jul 11, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post fu...Show more The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to update the plugins settings. CVE-2023-25030 may be a duplicate of this issue.Show less
CVE-2023-3076 1Inspireui 1Mstore Api Jun 17, 2026 Jul 10, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to a...Show more The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.Show less
CVE-2023-2796 1Myeventon 1Eventon Jun 17, 2026 Jul 10, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing thei...Show more The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.Show less
CVE-2023-20899 1Vmware 1Sd Wan Edge Firmware Jun 17, 2026 Jul 6, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
CVE-2023-30195 1Lineagrafica 1Lgdetailedorder Jun 17, 2026 Jul 6, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.

Previous 1...414415416...504 Next