CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- projectsendProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log...9.8 Critical
- cisco ucs director, unified computing system director +1 moreCisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability6.5 Medium
- cisco enterprise nfv infrastructure software, network functions virtualization infrastructure +1 moreCisco Enterprise NFV Infrastructure Software Information Disclosure Vulnerability6.5 Medium
- cisco enterprise nfv infrastructure software, network functions virtualization infrastructure +1 moreCisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability6.5 Medium
- elastic cloud enterpriseIn Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could...5.3 Medium
- foremanforeman before version 1.15.0 is vulnerable to an information leak through organizations and...4.3 Medium
- foremanforeman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper...4.3 Medium
- redhat cloudforms, red hat cfme, redhat cloudforms management engine +2 moreIt was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions...8.8 High
- google chromeInsufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed...5.4 Medium
- google chromeObject lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker...6.5 Medium
- google chromeInsufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed...6.5 Medium
- google chromeInsufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed...6.5 Medium
- ibm urbancode deployIBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive...3.1 Low
- phpmyfaqphpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass...2.7 Low
- aedes project aedesImproper Authorization in aedes5.3 Medium
- cisco prime collaboration, prime collaboration provisioning +1 moreA vulnerability in the password change function of Cisco Prime Collaboration Provisioning could...6.5 Medium
- opensuse openbuildservice, open build service +1 moredelete package via link exploit in open buildservice6.0 Medium
- opensuse openbuildservice, open build service +1 moreopenbuildservice allowed deleting packages via project links4.4 Medium
- redhat cloudforms, red hat cfme, redhat cloudforms management engine +2 moreA logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant...4.9 Medium
- hawt hawtio, redhat jboss fuse +1 moreInsecure cookie sharing in Hawtio8.7 High
- [unknown] fuse, debian linux, redhat enterprise linux desktop +2 more +4 moreIn fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction...5.3 Medium
- cisco mobility services engine 3310 firmware, mobility services engine 3355 firmware, mobility services engine 3365 firmware +2 moreA Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy...6.5 Medium
- ceph, redhat ceph storage, debian linux +6 more +8 moreA flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having...8.1 High
- [unknown] polkit, canonical ubuntu linux, debian linux +2 moreA flaw was found in polkit before version 0.116. The implementation of the...4.7 Medium
- synology universal searchImproper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0...6.5 Medium
- [unknown] setup, redhat enterprise linux desktop, enterprise linux server +1 more +3 moresetup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and...4.8 Medium
- beckhoff twincat, ics-cert beckhoff twincat +1 moreBeckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in...9.1 Critical
- sybase adaptive server enterpriseThe Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass...7.5 High
- moodleMoodle Improper Authentication8.1 High
- gitlab, gitlab community and enterprise editions +1 moreGitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the...6.5 Medium
- gitlab, debian linux, gitlab community and enterprise editions +2 moreGitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the...8.8 High
- ibm business process managerIBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2...4.3 Medium
- jenkins job and node ownershipImproper authorization in Jenkins Job and Node Ownership Plugin6.5 Medium
- freeipa ipa, freeipa +1 moreIpa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's...6.3 Medium
- opensuse open build serviceopen-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions4.4 Medium
- trend micro smart protection server (standalone), trendmicro smart protection server +1 moreA session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server ...8.8 High
- phoenixcontact fl switch 3004t-fx firmware, fl switch 3004t-fx st firmware, fl switch 3005 firmware +26 more +28 moreAn Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx...9.8 Critical
- keycloakKeycloak Oauth Implementation Error7.2 High
- pagure project pagurePagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization7.5 High
- arubanetworks clearpassAruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote...7.2 High
- sierra wireless airlink raven xe firmware, airlink raven xt firmware +1 moreAn Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions...9.8 Critical
- elastic kibanaKibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and...7.5 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization...7.8 High
- google android, qualcomm, inc. all qualcomm products +1 moreIn TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization...7.8 High
- zulip serverZulip Server 1.5.1 and below suffer from an error in the implementation of the...6.5 Medium
- postgresqlIt was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and...3.5 Low
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public...4.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an...3.5 Low
- bmc server automationThe RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows...5.3 Medium
- Show moreLoading…