CWE-862

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permis

SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via

Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earli

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access

The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacker

In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio

An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially c

In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. This could lead to loc

In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sensitive WiFi configura

In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of pack

In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missin

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization chec

Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.

An issue was discovered on Samsung mobile devices with O(8.x) software. There is clipboard Data Exposure via the Emergen

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lo

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, wh

An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote att

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All ver

zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Ex

zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zs

zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/man

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to

Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the

Intesync Solismed 3.3sp has Incorrect Access Control.

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.

The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor v

diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote at

SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.

Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform

An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevatio

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/St

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30

SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, res

Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72

A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCl

ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user,

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.

ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BA

A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection fo

A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationD

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 an

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exp

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher m

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClie