CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- obsidianObsidian does not require user confirmation for non-http/https URLs.9.8 Critical
- learning digital orca hcmLearningdigital.com, Inc. Orca HCM - Broken Authentication7.3 High
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreApplication specific tokens can change their own scope8.8 High
- cisco business process automation, business process automation (bpa) +1 moreCisco Business Process Automation Privilege Escalation Vulnerabilities8.8 High
- cisco business process automation, business process automation (bpa) +1 moreCisco Business Process Automation Privilege Escalation Vulnerabilities8.8 High
- linux tizen, samsung mobile tizen wearable devices +1 moreImproper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL...5.5 Medium
- dell storage managerQSAN Storage Manager - Improper Authorization9.1 Critical
- adobe magento commerce, magento +1 moreMagento Commerce improper Authorization via the 'Create Customer' endpoint6.5 Medium
- palo alto networks cortex xsoarCortex XSOAR: Unauthorized Usage of the REST API9.8 Critical
- gallagher command centreImproper Authorization vulnerability in Gallagher Command Centre Server allows command line...9.9 Critical
- gallagher command centreImproper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to...6.5 Medium
- samsung smart managerImproper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the...7.1 High
- google android, samsung mobile devices +1 moreImproper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.7.5 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 moreWindows Print Spooler Remote Code Execution Vulnerability7.8 High
- [unknown] cloudformsRed Hat Security Advisory: CloudForms 5.0.10 security, bug fix and enhancement update8.1 High
- redhat openstack-selinux, openstack platform +1 moreAn improper authorization flaw was discovered in openstack-selinux's applied policy where it does...6.5 Medium
- external media project media, minnur external media +1 moreExternal Media < 1.0.34 - Authenticated Arbitrary File Upload8.8 High
- denoStatic imports inside dynamically imported modules do not adhere to permission checks9.8 Critical
- redhat satellite, satellite capsule, theforeman foreman ansible +2 moreA flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not...6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreUsers registered with email verification can self re-activate their disabled accounts8.8 High
- wp-buy login as user or customer (user switching), login as user or customer \(user switching\) +1 moreLogin as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy login protection - limit failed login attempts, login protection – limit failed login attempts +1 moreLogin Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy visitor traffic real time statisticsVisitor Traffic Real Time Statistics < 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- sitemap project sitemap, wp-buy tree sitemap (pages, posts & categories list) +1 moreTree Sitemap < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy wp maintenance mode & site under construction, wpshopmart coming soon page \& maintenance mode +1 moreWP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy conditional marketing mailer, woocommerce conditional marketing mailer +1 moreWooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy captchinoo, captchinoo, google recaptcha for admin login page +1 moreCaptchinoo, Google recaptcha for admin login page < 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- wp-buy wp content copy protection & no right click, wp content copy protection \& no right click +1 moreWP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User8.8 High
- qnap hybrid backup sync, qnap systems inc. hbs 1.3, hbs 2 +2 more +4 moreImproper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)10.0 Critical
- apache ozoneOzone S3 Gateway allows bucket and key access to non authenticated users7.5 High
- google android, samsung mobile devices +1 moreAn improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020...6.1 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SNMP fails to properly perform authorization checks on incoming received SNMP requests.7.3 High
- adobe bridgeAdobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-Service5.5 Medium
- go-vela vela, devolutions server +1 moreReject unauthorized access with GitHub PATs7.5 High
- samsung accountUsing unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below,...5.5 Medium
- samsung membersAn improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink...8.6 High
- samsung customization serviceUsing unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x),...5.5 Medium
- github enterprise serverImproper access control in GitHub Enterprise Server leading to unauthorized read access to private repository metadata6.5 Medium
- oauth2-proxy, oauth2 proxy project proxy +1 moreIncorrect authorization in OAuth2-Proxy5.5 Medium
- samsung notesUsing unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers...5.5 Medium
- samsung internetImproper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch...3.3 Low
- samsung galaxy themesUsing empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to...5.5 Medium
- samsung bixby voiceUsing PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows...5.5 Medium
- samsung accountImproper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and...3.2 Low
- moodleA vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and...4.3 Medium
- minioBypassing readOnly policy by creating a temporary 'mc share upload' URL7.7 High
- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests8.1 High
- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks6.5 Medium
- github, github enterprise server +1 moreImproper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories6.5 Medium
- gnu grub2, fedoraproject fedora, netapp ontap select deploy administration utility +5 more +7 moreA flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure...7.5 High
- Show moreLoading…