CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- huawei p9 firmware, p9 lite firmware +1 moreHuawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones...4.6 Medium
- siemens ruggedcom rox iSiemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions...8.8 High
- siemens ruggedcom rox iSiemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated...6.5 Medium
- nextcloud serverNextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on...4.3 Medium
- apple watchos, iphone os +1 moreAn issue was discovered in certain Apple products. iOS before 10.2 is affected. watchOS before 3...5.3 Medium
- google android, linux kernel +1 morePossible unauthorized memory access in the hypervisor. Incorrect configuration provides access to...7.8 High
- cisco intercloud fabricA vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers...8.8 High
- digium asterisk, certified asterisk +1 moreAn issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14...5.3 Medium
- ge bently nevada 3500\/22m serial firmware, bently nevada 3500\/22m usb firmware +1 moreGeneral Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500...10.0 Critical
- clusterlabs pacemaker, redhat enterprise linux server, enterprise linux server eus +2 moreAn authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its...8.8 High
- linux kernelThe filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a...4.4 Medium
- wptf-image-gallery project wptf-image-galleryRemote file download vulnerability in wptf-image-gallery v1.037.5 High
- emc vipr srmEMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which...9.8 Critical
- microsoft windows 10, windows 8.1, windows rt 8.1 +2 moreMicrosoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check...8.8 High
- huawei rh1288 v3 server firmware, rh2288 v3 server firmware, rh2288h v3 server firmware +3 more +5 moreHuawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3...9.8 Critical
- charybdis project charybdis, debian linux +1 moreThe m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers...8.1 High
- netgear readynas surveillance, nuuo nvrmini 2, nvrsolo +2 morecgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and...7.5 High
- moxa oncell g3001 firmware, oncell g3100v2 firmware +1 moreMoxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do...9.8 Critical
- wordpress, debian linux +1 moreWordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining...8.6 High
- haxx libcurl, debian linux, opensuse leap +2 morecurl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS...7.5 High
- rockwellautomation factorytalk energrymetrixRockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon...7.3 High
- google chromeWebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82,...8.8 High
- google chromeThe ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as...8.8 High
- kubernetesAuthorization bypass in Openshift9.8 Critical
- dockerArbitrary File Override in Docker Engine3.6 Low
- dockerInformation Exposure in Docker Engine7.2 High
- dockerArbitrary Code Execution10.0 High
- dockerAccess Restriction Bypass in Docker5.0 Medium
- emerson deltavEmerson DeltaV Use of Improper Authorization6.2
- apache xalan-java, oracle webcenter sites +1 moreImproper Authorization in Apache Xalan-Java7.5 High