CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- dell avamar, emc avamar server, emc integrated data protection appliance +2 moreDell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in...8.1 High
- adobe magento commerce, magento +1 moreMagento Commerce Incorrect permissions Could Lead To Unauthorized Access5.3 Medium
- adobe magento commerce, magento +1 moreMagento Commerce Incorrect permissions Could Lead To Unauthorized Access5.3 Medium
- abb ability™ symphony® plus historian, ability™ symphony® plus operations, symphony \+ historian +1 more +3 moreImproper Authorization in Symphony Plus8.8 High
- gerritOveroptimization leads to private information leak in Gerrit3.5 Low
- gerritInformation leakage in Gerrit3.5 Low
- pimcoreAuthorization bypass in Pimcore7.7 High
- johnsoncontrols victor web, johnson controls c•cure web client version 2.90 and prior (note - this does not affect the new web-based c•cure 9000 client that was introduced in c•cure 9000 v2.90), victor web client version 5.6 and prior +1 more +3 morevictor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability7.1 High
- palo alto networks pan-osPAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification8.2 High
- magento, adobe magento commerce +1 moreIncorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API2.7 Low
- magento, adobe magento commerce +1 moreIncorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data4.3 Medium
- magento, adobe magento commerce +1 moreIncorrect permissions could lead to unauthorized modification of inventory source data via REST API2.7 Low
- magento, adobe magento commerce +1 moreIncorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API4.9 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC for macOS Dynamic Library Injection Vulnerability4.4 Medium
- facebook whatsapp business for ios, whatsapp, whatsapp business +1 more +3 moreImproper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior...4.6 Medium
- cogboard red discord bot, cog-creators red-discordbot +1 moreUnauthorized privilege escalation in Mod module7.7 High
- dell emc networker, networker +1 moreDell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability....6.8 Medium
- pepperl+fuchs p+f comtrol rocketlinx, korenix jetnet, pepperl-fuchs es7506 firmware +13 more +15 morePepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products9.8 Critical
- johnsoncontrols victor web client, johnson controls victor web client version 5.4.1 and prior, tyco c-cure web client +2 morevictor Web Client - Arbitrary File Deletion Vulnerability7.1 High
- schneider-electric scadapack 7x remote connectA CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574...8.8 High
- gallagher command centreIn Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5),...9.9 Critical
- sap bank analyzer, s\/4hana for financial products subledger, sap se banking services from sap 9.0(bank analyzer) +1 more +3 moreBanking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial...6.5 Medium
passport-cognitonpmImproper Authorization in passport-cognitoNo scoregraphql-shieldnpmAuthorization Bypass in graphql-shieldNo score@sap-cloud-sdk/corenpmImproper Authorization in @sap-cloud-sdk/coreNo scorereact-oauth-flownpmImproper Authorization in react-oauth-flowNo scoregoogleapisnpmImproper Authorization in googleapisNo scoreloopbacknpmImproper Authorization in loopbackNo score- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to the enumeration of private repository names4.3 Medium
- cisco nx-os, nx-os software +1 moreCisco Nexus 3000 and 9000 Series Switches Privilege Escalation Vulnerability7.8 High
- siemens automation license manager 5, automation license manager 6, automation license manager +2 moreA vulnerability has been identified in Automation License Manager 5 (All versions), Automation...7.8 High
- jenkins pipeline maven integration, jenkins project pipeline maven integration plugin +1 moreMissing permission check in Jenkins Pipeline Maven Integration Plugin allow capturing credentials6.5 Medium
- jenkins pipeline maven integration, jenkins project pipeline maven integration plugin +1 moreMissing permission check in Jenkins Pipeline Maven Integration Plugin allows enumerating credentials IDs6.5 Medium
- cisco sd-wan vmanage, sd-wan +1 moreCisco SD-WAN vManage Software Authorization Bypass Vulnerability9.9 Critical
- cisco data center network managerCisco Data Center Network Manager Improper Authorization Vulnerability8.8 High
- open source openclinic ga, openclinic ga project ga +1 moreOpenClinic GA6.3 Medium
- cisco rv110w wireless-n vpn firewall firmware, rv110w firmware, rv215w firmware +2 moreCisco Small Business RV110W and RV215W Series Routers Information Disclosure Vulnerability5.9 Medium
- dell powerprotect data manager, power protect data manager, powerprotect x400 firmware +2 moreDell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions...7.7 High
- jenkins zephyr for jira test management, jenkins project zephyr for jira test management plugin +1 moreMissing permission checks in Zephyr for JIRA Test Management Plugin4.3 Medium
- jenkins fortify on demand, jenkins project fortify on demand plugin +1 moreMissing permission checks in Jenkins Fortify on Demand Plugin5.4 Medium
- jenkins fortify on demand, jenkins project fortify on demand plugin +1 moreUsers with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin4.3 Medium
- prestosql prestoPrivilege escalation in Presto7.4 High
- auth0 express-jwtAuthorization bypass in express-jwt7.7 High
- [unknown] cephAn authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the...8.0 High
- dell client consumer and commercial platforms, chengming 3967 firmware, chengming 3977 firmware +352 more +354 moreDell Client Consumer and Commercial platforms include an improper authorization vulnerability in...7.1 High
- cisco unified contact center expressCisco Unified Contact Center Express Improper API Authorization Vulnerability5.4 Medium
- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to privilege escalation of organization member9.8 Critical
- jenkins project inheritance, jenkins project inheritance plugin +1 moreMissing permission check in Jenkins Project Inheritance Plugin4.3 Medium
- jenkins project self-organizing swarm plug-in modules plugin, jenkins self-organizing swarm modules +1 moreImproper permission checks in Jenkins Swarm Plugin4.3 Medium
- opto22 softpac projectOpto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any...9.8 Critical
- Show moreLoading…