CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- palo alto networks pan-osPAN-OS: Improper SAML SSO authorization of shared local users5.4 Medium
- jenkins amazon ec2, jenkins project amazon ec2 plugin +1 moreUsers with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin4.3 Medium
- jenkins copy artifact, jenkins project copy artifact plugin +1 moreImproper permission checks in Jenkins Copy Artifact Plugin6.5 Medium
- keycloakKeycloak users may be able to remove MFA from other users' devices4.1 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in...4.3 Medium
- red hat undertowImproper Authorization in Undertoe8.6 High
- ge mark vie control systemGE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an...8.8 High
- elideRead permissions not enforced for client provided filter expressions in Elide http client6.8 Medium
- sensiolabs symfonyFirewall configured with unanimous strategy was not actually unanimous in symfony/security-http7.6 High
- [unknown] moodleMoodle Email media URL tokens were not checking for user status3.7 Low
- lab digital wagtail-2fa2FA bypass through deleting devices in wagtail-2fa7.6 High
- jenkins mac, jenkins project mac plugin +1 moreMissing permission checks in Mac Plugin4.3 Medium
- prestashopPossible information disclosure in PrestaShop7.6 High
- parse-community parse-serverInformation disclosure in parse-server7.7 High
- postgresql, redhat decision manager, enterprise linux +1 more +3 moreA flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub...3.1 Low
- jenkins pipeline github notify step, jenkins project pipeline github notify step plugin +1 moreUsers with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin4.3 Medium
- jenkins pipeline github notify step, jenkins project pipeline github notify step plugin +1 moreMissing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials4.3 Medium
- dell emc isilon onefs, isilon onefs +1 moreDell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreImproper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a...4.3 Medium
- nextcloud circlesImproper authorization in the Circles app 0.17.7 causes retaining access when an email address...4.3 Medium
- ens.domains ethereum name service, ensdomains @ensdomains/ens +1 moreEthereum Name Service - Malicious takeover of previously owned ENS names8.7 High
- apereo opencastAuthentication Bypass For Endpoints With Anonymous Access in OpenCast8.7 High
- apereo opencastOpencast users with ROLE_COURSE_ADMIN can create new users4.8 Medium
- jenkinsMemory usage graphs accessible to anyone with Overall/Read4.3 Medium
- jenkins sounds, jenkins project sounds plugin +1 moreMissing permission checks in Jenkins Sounds Plugin allow OS command execution8.8 High
- sonicwall sonicos, sonicosv +1 moreA vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to...7.2 High
- sonicwall email security applianceA vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform...9.8 Critical
- jenkins alauda devops pipeline, jenkins project alauda devops pipeline plugin +1 moreJenkins Alauda DevOps Pipeline Plugin allows attackers with Overall/Read permission to capture credentials stored in Jenkins6.5 Medium
- jenkins rapiddeploy, jenkins project rapiddeploy plugin +1 moreJenkins RapidDeploy Plugin missing permission check4.3 Medium
- jenkins gerrit trigger, jenkins project gerrit trigger plugin +1 moreMissing permission check in Jenkins Gerrit Trigger Plugin5.4 Medium
- barco clickshare cs-100 firmware, clickshare cse-200\+ firmware, clickshare cse-200 firmware +1 more +3 moreOn Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is...5.9 Medium
- red hat samba, canonical ubuntu linux, debian linux +2 more +4 moreAll Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an...5.4 Medium
- cisco small business rv series router firmware, rv016 multi-wan vpn firmware, rv042 dual wan vpn firmware +2 more +4 moreCisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability5.3 Medium
- jenkins google compute engine, jenkins project google compute engine plugin +1 moreJenkins Google Compute Engine Plugin Missing Authorization vulnerability4.3 Medium
- mcafee threat intelligence exchange server, mcafee,llc threat intelligence exchange server (tie server) +1 moreExploitation of Authorization in TIE Server4.5 Medium
- dell idrac7 firmware, idrac8 firmware, idrac9 firmware +1 more +3 moreDell EMC iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an...5.0 Medium
- jenkins kubernetes ci, jenkins project elasticbox jenkins kubernetes ci/cd plugin +1 moreJenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration6.5 Medium
- jenkins kubernetes ci, jenkins project elasticbox jenkins kubernetes ci/cd plugin +1 moreJenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization6.5 Medium
- eclipse openj9, the eclipse foundation eclipse openj9, redhat enterprise linux +5 more +7 moreFrom Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or...9.1 Critical
- jenkins crx content package deployer, jenkins project crx content package deployer plugin +1 moreJenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization4.3 Medium
- jenkins crx content package deployer, jenkins project crx content package deployer plugin +1 moreJenkins CRX Content Package Deployer Plugin subject to Missing Authorization6.5 Medium
- rpyc project rpycDuplicate Advisory: Possible remote code execution via a remote procedure call7.5 High
- cisco ios xe, ios xe software 3.2.9sg +1 moreCisco IOS XE Software Consent Token Bypass Vulnerability6.7 Medium
- tridium niagara, niagara ax, niagara4 +2 moreA specific utility may allow an attacker to gain read access to privileged files in the Niagara...4.4 Medium
- advantech webaccessIn WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an...9.8 Critical
- cisco content security management appliance (sma), content security management appliance +1 moreCisco Content Security Management Appliance Information Disclosure Vulnerability4.3 Medium
- cisco unified computing system (management software), integrated management controller supervisor, unified computing system +2 moreCisco Integrated Management Controller Substring Comparison Privilege Escalation Vulnerability8.8 High
- cisco unified computing system e-series software (ucse), integrated management controller supervisor, unified computing system +2 moreCisco Integrated Management Controller Privilege Escalation Vulnerability6.5 Medium
- clickhouseIncorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized...9.8 Critical
- floragunn search guardSearch Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled,...6.5 Medium
- Show moreLoading…