Vulnerabilities > Missing Authorization
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-27 | CVE-2021-37270 | Missing Authorization vulnerability in S-Cms CMS Enterprise Website Construction System 5.0 There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. | 10.0 |
| 2021-09-27 | CVE-2021-24633 | Missing Authorization vulnerability in Wpdeveloper Countdown Block The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users. | 4.0 |
| 2021-09-22 | CVE-2021-34647 | Missing Authorization vulnerability in Ninjaforms Ninja Forms The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. | 6.5 |
| 2021-09-22 | CVE-2021-34648 | Missing Authorization vulnerability in Ninjaforms Ninja Forms The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. | 4.3 |
| 2021-09-20 | CVE-2021-24635 | Missing Authorization vulnerability in Bootstrapped Visual Link Preview The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL | 5.4 |
| 2021-09-20 | CVE-2021-24639 | Missing Authorization vulnerability in FFW Omgf The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. | 8.1 |
| 2021-09-15 | CVE-2021-33704 | Missing Authorization vulnerability in SAP Business ONE 10.0 The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. | 6.5 |
| 2021-09-15 | CVE-2021-22147 | Missing Authorization vulnerability in Elastic Elasticsearch Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. | 6.5 |
| 2021-09-15 | CVE-2021-22149 | Missing Authorization vulnerability in Elastic Enterprise Search Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. | 8.8 |
| 2021-09-14 | CVE-2021-41077 | Missing Authorization vulnerability in Travis-Ci Travis CI The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. | 4.3 |