CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- cisco adaptive security appliance software, adaptive security appliance (asa) software +1 moreCisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation Vulnerability8.8 High
- cisco small business 220 series smart plus switches, sf-220-24 firmware, sf220-24p firmware +9 more +11 moreCisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability9.1 Critical
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreAuthorization session conflation7.1 High
- adobe systems incorporated magento 2, magento +1 moreMagento Insufficient authorization check when adding users to company accounts6.5 Medium
- cpanelbin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).5.7 Medium
- cpanelcPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).7.2 High
- cpanelcPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382).3.8 Low
- cpanelcPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).8.1 High
- jenkins project pipeline: shared groovy libraries plugin, jenkins pipeline\, redhat openshift container platform +2 moreMissing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin4.3 Medium
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreMissing Authorization in Jenkins Configuration as Code Plugin4.3 Medium
- printeron central print servicesAn issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core...8.8 High
- gitlabGitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that...6.5 Medium
- gitlabGitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is...7.5 High
- gitlabGitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1,...8.8 High
- cloudera cdhThe provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on ...7.5 High
- dlink dcs-1130 firmwareAn issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to...7.5 High
- moodleMoodle all messaging conversations could be viewed6.5 Medium
- cisco rv130w wireless-n multifunction vpn router firmware, rv110w firmware, rv130w firmware +1 more +3 moreCisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability5.3 Medium
- cisco rv130w wireless-n multifunction vpn router firmware, rv110w firmware, rv130w firmware +1 more +3 moreCisco RV110W, RV130W, and RV215W Routers Denial of Service Vulnerability5.3 Medium
- cisco rv130w wireless-n multifunction vpn router firmware, rv110w firmware, rv130w firmware +1 more +3 moreCisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm ipq8074 firmware, mdm9150 firmware +45 more +47 moreTruncated access authentication token leads to weakened access control for stored secure...7.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm ipq4019 firmware, ipq8074 firmware +53 more +55 moreKernel can inject faults in computations during the execution of TrustZone leading to information...5.5 Medium
- red hat cfme, redhat cfme-gemset, cloudforms +2 morecfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to...4.3 Medium
- siemens siveillance vms 2017 r2, siveillance vms 2018 r1, siveillance vms 2018 r2 +7 more +9 moreA vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a),...7.1 High
- siemens siveillance vms 2017 r2, siveillance vms 2018 r1, siveillance vms 2018 r2 +7 more +9 moreA vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a),...8.8 High
- cisco ios xr software, ios xr firmware +1 moreCisco IOS XR Software Secure Shell Authentication Vulnerability5.4 Medium
- fortinet fortios, fortiproxy, fortios, fortiproxy +1 more +3 moreAn Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5...9.1 Critical
- apache hadoopPrivilege escalation vulnerability in Apache Hadoop8.8 High
- open-xchange ox cloudOpen-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization.7.2 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability6.8 Medium
- cisco small business 200 series smart switches, sf200-24 firmware, sf200-24fp firmware +112 more +114 moreCisco Small Business Switches Secure Shell Certificate Authentication Bypass Vulnerability7.2 High
- systemd, debian linux, fedoraproject fedora +1 more +3 moreIn systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the...4.5 Medium
- axiomsl axiomAxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI...9.8 Critical
- apache hbaseImproper Authorization in org.apache.hbase:hbase7.5 High
- [unknown] moodleMoodle Users could elevate their role when accessing the LTI tool on a provider site6.3 Medium
- hospira plum a+ infusion system, plum a+3 infusion system, symbiq infusion system +3 more +5 moreHospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and...9.8 Critical
- cloud foundry capi, cloudfoundry capi-release +1 moreCloud Controller provides signed URL with write authorization to read only user6.5 Medium
- cisco nexus 3000 series switches, nexus 3500 platform switches, nexus 3600 platform switches +4 more +6 moreCisco NX-OS Software Privilege Escalation Vulnerability7.3 High
- cisco nexus 3000 series switches, nexus 3500 platform switches, nexus 3600 platform switches +3 more +5 moreCisco NX-OS Software Privilege Escalation Vulnerability7.8 High
- sonicwall sonicos, sonicosv +1 moreIn SonicWall SonicOS, administrators without full permissions can download imported certificates....5.5 Medium
- gnome gnome-shell, canonical ubuntu linux, opensuse leap +2 moreIt was discovered that the gnome-shell lock screen since version 3.15.91 did not properly...4.8 Medium
- [unknown] satelliteAn improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can...6.8 Medium
- jenkins, redhat openshift container platform +1 moreImproper Authorization in Jenkins Core7.2 High
- jenkins, redhat openshift container platform +1 moreImproper Authorization in Jenkins Core7.2 High
- [unknown] ceph, canonical ubuntu linux, debian linux +3 more +5 moreIt was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions...3.5 Low
- etcd, fedoraproject fedora, redhat enterprise linux desktop +3 more +5 morego.etcd.io/etcd Authentication Bypass6.8 Medium
- jenkinsImproper Authorization in Jenkins6.5 Medium
- cisco adaptive security appliance software, adaptive security appliance (asa) software +1 moreCisco Adaptive Security Appliance Software Privilege Escalation Vulnerability8.1 High
- [unknown] keycloakImproper Authentication in Keycloak6.1 Medium
- ics-cert vgo robot, vecna vgo firmware +1 moreVGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected...8.8 High
- Show moreLoading…