CWE-862

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8

A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, th

An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalat

A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer runni

SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not pe

There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use t

Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its a

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are

Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the

FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check

Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted I

Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite

IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listenin

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it

File Deletion vulnerability in Halo 0.4.3 via delBackup.

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers th

BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrar

An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a deni

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directorie

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links wh

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections,

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attac

Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass naviga

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to r

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does n

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprot

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are miss

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1

The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or n

The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or n

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks W

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient n

SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perfor

Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate p

Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the a

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing autho

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMC

ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functio

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authen

Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authen

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users,

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, imper

A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated a

SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for a

In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a mi

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated atta

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior t