CWE-862

The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e

A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Re

A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission t

Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read pe

Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send

A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credent

The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and rev

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overa

A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlie

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read per

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read per

The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_option

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, a

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_re

A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Ove

A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permissio

Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to co

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not c

An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server meth

Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJA

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_sav

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent

Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-ad

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deacti

The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessi

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an i

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the Se

The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter fou

Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.

wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.

A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to c

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypas

Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interacti

Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assign

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks

Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key

Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video wi

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most

A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read pe

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected ver