CWE-862 Missing Authorization
classThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (11437)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-84869US | —OT kritisch | KEV | ||
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circum… | ||||
| CVE-2026-63219US | —OT kritisch | — | ||
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is… | ||||
| CVE-2026-41679US | —OT kritisch | Exploit | ||
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote… | ||||
| CVE-2025-40602US | —OT kritisch | KEV | ||
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). | ||||
| CVE-2025-20362US | high8.6OT kritisch | KEV | ||
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by… | ||||
| CVE-2025-6205US | —OT kritisch | KEV | ||
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application. | ||||
| CVE-2023-52163US | —OT kritisch | KEV | ||
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2024-57726US | critical9.9OT kritisch | KEV | ||
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be… | ||||
| CVE-2022-0492US | high7.8OT kritisch | KEV | ||
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the… | ||||
| CVE-2022-0543US | critical10.0OT kritisch | KEV | ||
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code exec… | ||||
| CVE-2022-20701US | high7.8OT kritisch | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2021-37976US | medium6.5OT kritisch | KEV | ||
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafte… | ||||
| CVE-2021-39226US | high7.3OT kritisch | KEV | ||
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by ac… | ||||
| CVE-2021-30713US | high7.8OT kritisch | KEV | ||
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is a… | ||||
| CVE-2021-30657US | medium5.5OT kritisch | KEV | ||
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekee… | ||||
| CVE-2021-26085US | medium5.3OT kritisch | KEV | ||
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint.… | ||||
| CVE-2020-8196US | medium4.3OT kritisch | KEV | ||
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.… | ||||
| CVE-2021-21978US | critical9.8OT kritisch | Exploit | ||
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file… | ||||
| CVE-2023-6875US | critical9.8OT kritisch | Exploit | ||
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification… | ||||
| CVE-2021-21307US | critical9.8OT kritisch | Exploit | ||
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.9… | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan