CWE-862

In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when anothe

Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorre

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Mark

In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local in

In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local in

In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local in

In handle_ramdump of pixel_loader.c, there is a possible way to create a ramdump of non-secure memory due to a missing p

In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. T

In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a m

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest p

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest p

A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form va

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with

Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enum

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_

An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting fr

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do n

A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permis

A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its co

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lsw

The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in it

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A use

Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Next

Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle ve

The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with

A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers wi

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers w

A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permiss

The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as r

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with

A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read p

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with

A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read p

Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project

Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permissi

The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-ex

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action,

The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enum

An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an u

The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of se

A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to con

A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read pe