CWE-862 · 9 343 записей
Missing Authorization
CVE этого класса
9 363 записей
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
100Срочно | CVE-2022-0543Готовый эксплойт | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escaperedis · redis · CWE-862 | Критическая10,0 | KEV | 99,4 % | 18 февр. 2022 г. |
94Срочно | CVE-2023-52163Готовый эксплойт | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.digiever · ds-2105 pro firmware · CWE-862 | Высокая8,8 | KEV | 96,9 % | 3 февр. 2025 г. |
90Срочно | CVE-2025-20362Готовый эксплойт | Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTcisco · adaptive security appliance software · CWE-862 | Высокая8,6 | KEV | 87,1 % | 25 сент. 2025 г. |
89Срочно | CVE-2024-57726Готовый эксплойт | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excesimple-help · simplehelp · CWE-862 | Критическая9,9 | KEV | 66,6 % | 15 янв. 2025 г. |
88Срочно | CVE-2025-6205Готовый эксплойт | Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 20253ds · delmia apriso · CWE-862 | Критическая9,1 | KEV | 73,3 % | 4 авг. 2025 г. |
73На этой неделе | CVE-2021-30657Готовый эксплойт | A logic issue was addressed with improved state management.apple · mac os x · CWE-862 | Средняя5,5 | KEV | 68,5 % | 8 сент. 2021 г. |
66На этой неделе | CVE-2021-21307Готовый эксплойт | Remote Code Exploit in Lucee Adminlucee · lucee server · CWE-862 | Критическая9,8 | — | 89,2 % | 11 февр. 2021 г. |
65На этой неделе | CVE-2020-8772Готовый эксплойт | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.revmakx · infinitewp client · CWE-862 | Критическая9,8 | — | 88,0 % | 6 февр. 2020 г. |
65На этой неделе | CVE-2018-6000Готовый эксплойт | An issue was discovered in AsusWRT before 3.0.0.4.384_10007.asus · asuswrt · CWE-862 | Критическая9,8 | — | 85,2 % | 22 янв. 2018 г. |
63На этой неделе | CVE-2023-26035Готовый эксплойт | ZoneMinder vulnerable to Missing Authorizationzoneminder · zoneminder · CWE-862 | Критическая9,8 | — | 80,5 % | 24 февр. 2023 г. |
63На этой неделе | CVE-2019-15954Готовый эксплойт | An issue was discovered in Total.js CMS 12.0.0.totaljs · total.js cms · CWE-862 | Критическая9,9 | — | 78,7 % | 5 сент. 2019 г. |
63На этой неделе | CVE-2021-30713Готовый эксплойт | A permissions issue was addressed with improved validation.apple · mac os x · CWE-862 | Высокая7,8 | KEV | 7,0 % | 8 сент. 2021 г. |
62На этой неделе | CVE-2024-41730Эксплойта нет | Missing Authentication check in SAP BusinessObjects Business Intelligence Platformsap · business objects business intelligence platform · CWE-862 | Критическая9,8 | — | 75,9 % | 13 авг. 2024 г. |
62На этой неделе | CVE-2021-37976Готовый эксплойт | Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive infogoogle · chrome · CWE-862 | Средняя6,5 | KEV | 19,9 % | 8 окт. 2021 г. |
60На этой неделе | CVE-2022-23944Proof of concept | Apache ShenYu 2.4.1 Improper access controlapache · shenyu · CWE-862 | Критическая9,1 | — | 79,0 % | 25 янв. 2022 г. |
60На этой неделе | CVE-2021-45467Proof of concept | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.phcontrol-webpanel · webpanel · CWE-862 | Критическая9,8 | — | 70,7 % | 26 дек. 2022 г. |
59В плане | CVE-2021-32172Proof of concept | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.maianscriptworld · maian cart · CWE-862 | Критическая9,8 | — | 66,4 % | 7 окт. 2021 г. |
57В плане | CVE-2024-31997Эксплойта нет | XWiki Platform remote code execution from account through UIExtension parametersxwiki · xwiki · CWE-862 | Высокая8,8 | — | 73,9 % | 10 апр. 2024 г. |
57В плане | CVE-2025-11833Proof of concept | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Losaadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app · CWE-862 | Критическая9,8 | — | 60,3 % | 1 нояб. 2025 г. |
55В плане | CVE-2018-10093Proof of concept | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.audiocodes · 420hd ip phone firmware · CWE-862 | Высокая8,8 | — | 68,2 % | 21 мар. 2019 г. |
55В плане | CVE-2024-11972Proof of concept | Hunk Companion < 1.9.0 - Unauthenticated Plugin Installationthemehunk · hunk companion · CWE-862 | Критическая9,8 | — | 54,5 % | 31 дек. 2024 г. |
55В плане | CVE-2025-5394Proof of concept | Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installationbearsthemes · alone – charity multipurpose non-profit wordpress theme · CWE-862 | Критическая9,8 | — | 52,8 % | 15 июл. 2025 г. |
54В плане | CVE-2018-1217Proof of concept | Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1dell · emc avamar · CWE-862 | Критическая9,8 | — | 50,9 % | 9 апр. 2018 г. |
54В плане | CVE-2020-36239Эксплойта нет | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 batlassian · jira data center · CWE-862 | Критическая9,8 | — | 49,8 % | 29 июл. 2021 г. |
54В плане | CVE-2017-9232Готовый эксплойт | Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing canonical · juju · CWE-862 | Критическая9,8 | — | 48,5 % | 27 мая 2017 г. |
- CVE-2022-0543100Срочно
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 99 %redis · redis18 февр. 2022 г.
- CVE-2023-5216394Срочно
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 97 %digiever · ds-2105 pro firmware3 февр. 2025 г.
- CVE-2025-2036290Срочно
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FT
ВысокаяCVSS 8,6KEVГотовый эксплойтEPSS 87 %cisco · adaptive security appliance software25 сент. 2025 г.
- CVE-2024-5772689Срочно
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 67 %simple-help · simplehelp15 янв. 2025 г.
- CVE-2025-620588Срочно
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 73 %3ds · delmia apriso4 авг. 2025 г.
- CVE-2021-3065773На этой неделе
A logic issue was addressed with improved state management.
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 69 %apple · mac os x8 сент. 2021 г.
- CVE-2021-2130766На этой неделе
Remote Code Exploit in Lucee Admin
КритическаяCVSS 9,8Готовый эксплойтEPSS 89 %lucee · lucee server11 февр. 2021 г.
- CVE-2020-877265На этой неделе
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.
КритическаяCVSS 9,8Готовый эксплойтEPSS 88 %revmakx · infinitewp client6 февр. 2020 г.
- CVE-2018-600065На этой неделе
An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
КритическаяCVSS 9,8Готовый эксплойтEPSS 85 %asus · asuswrt22 янв. 2018 г.
- CVE-2023-2603563На этой неделе
ZoneMinder vulnerable to Missing Authorization
КритическаяCVSS 9,8Готовый эксплойтEPSS 80 %zoneminder · zoneminder24 февр. 2023 г.
- CVE-2019-1595463На этой неделе
An issue was discovered in Total.js CMS 12.0.0.
КритическаяCVSS 9,9Готовый эксплойтEPSS 79 %totaljs · total.js cms5 сент. 2019 г.
- CVE-2021-3071363На этой неделе
A permissions issue was addressed with improved validation.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 7 %apple · mac os x8 сент. 2021 г.
- CVE-2024-4173062На этой неделе
Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
КритическаяCVSS 9,8Эксплойта нетEPSS 76 %sap · business objects business intelligence platform13 авг. 2024 г.
- CVE-2021-3797662На этой неделе
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive info
СредняяCVSS 6,5KEVГотовый эксплойтEPSS 20 %google · chrome8 окт. 2021 г.
- CVE-2022-2394460На этой неделе
Apache ShenYu 2.4.1 Improper access control
КритическаяCVSS 9,1Proof of conceptEPSS 79 %apache · shenyu25 янв. 2022 г.
- CVE-2021-4546760На этой неделе
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.ph
КритическаяCVSS 9,8Proof of conceptEPSS 71 %control-webpanel · webpanel26 дек. 2022 г.
- CVE-2021-3217259В плане
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
КритическаяCVSS 9,8Proof of conceptEPSS 66 %maianscriptworld · maian cart7 окт. 2021 г.
- CVE-2024-3199757В плане
XWiki Platform remote code execution from account through UIExtension parameters
ВысокаяCVSS 8,8Эксплойта нетEPSS 74 %xwiki · xwiki10 апр. 2024 г.
- CVE-2025-1183357В плане
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Lo
КритическаяCVSS 9,8Proof of conceptEPSS 60 %saadiqbal · post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app1 нояб. 2025 г.
- CVE-2018-1009355В плане
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.
ВысокаяCVSS 8,8Proof of conceptEPSS 68 %audiocodes · 420hd ip phone firmware21 мар. 2019 г.
- CVE-2024-1197255В плане
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
КритическаяCVSS 9,8Proof of conceptEPSS 54 %themehunk · hunk companion31 дек. 2024 г.
- CVE-2025-539455В плане
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
КритическаяCVSS 9,8Proof of conceptEPSS 53 %bearsthemes · alone – charity multipurpose non-profit wordpress theme15 июл. 2025 г.
- CVE-2018-121754В плане
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1
КритическаяCVSS 9,8Proof of conceptEPSS 51 %dell · emc avamar9 апр. 2018 г.
- CVE-2020-3623954В плане
Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b
КритическаяCVSS 9,8Эксплойта нетEPSS 50 %atlassian · jira data center29 июл. 2021 г.
- CVE-2017-923254В плане
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing
КритическаяCVSS 9,8Готовый эксплойтEPSS 49 %canonical · juju27 мая 2017 г.