Vulnerabilities > Missing Authorization
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-12-18 | CVE-2019-15013 | Missing Authorization vulnerability in Atlassian Jira The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check. | 4.3 |
| 2019-12-17 | CVE-2019-16576 | Missing Authorization vulnerability in Jenkins Alauda Kubernetes Support A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. | 6.5 |
| 2019-12-17 | CVE-2019-16574 | Missing Authorization vulnerability in Jenkins Alauda Devops Pipeline A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | 6.5 |
| 2019-12-17 | CVE-2019-16571 | Missing Authorization vulnerability in Jenkins Rapiddeploy A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server. | 4.3 |
| 2019-12-17 | CVE-2019-16567 | Missing Authorization vulnerability in Jenkins Team Concert A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | 4.3 |
| 2019-12-17 | CVE-2019-16566 | Missing Authorization vulnerability in Jenkins Team Concert A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | 6.5 |
| 2019-12-12 | CVE-2019-15932 | Missing Authorization vulnerability in Intesync Solismed 3.3 Intesync Solismed 3.3sp has Incorrect Access Control. | 9.8 |
| 2019-12-11 | CVE-2019-19604 | Missing Authorization vulnerability in multiple products Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository. | 7.8 |
| 2019-12-10 | CVE-2019-13748 | Missing Authorization vulnerability in multiple products Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 6.5 |
| 2019-12-06 | CVE-2019-2229 | Missing Authorization vulnerability in Google Android In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. | 5.5 |