CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- google android, samsung mobile devices +1 moreKeeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1...4.0 Medium
- google android, samsung mobile devices +1 moreImproper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to...4.0 Medium
- google android, samsung mobile devices +1 moreImplicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1...4.0 Medium
- google android, samsung mobile devices +1 moreIncorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically...6.1 Medium
- aeon labs zw090-a, samsung sth-eth-200, silabs uzb-7 +5 more +7 moreZ-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited...6.5 Medium
- openwhyd, openwhyd openwhyd/openwhyd +1 moreImproper Authorization in openwhyd/openwhyd8.6 High
- shapedplugin logo carousel, unknown logo carousel – logo slider, logo showcase, and clients logo gallery +1 moreLogo Carousel < 3.4.2 - Unauthorised Private Post Access8.1 High
- humhubAuthorization Bypass in Space Invite in HumHub6.5 Medium
- samsung internetInsecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows...4.0 Medium
- ivanti avalancheAn improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an...8.8 High
- dell emc networker, networker +1 moreDell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any...6.0 Medium
- 4mosan gcb doctor4MOSAn GCB Doctor - Improper Authorization9.8 Critical
- aifu information technology co. cash, aifu cashier accounting management system +1 moreTVN-2021100094.3 Medium
- sap commerceSAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary...8.8 High
- samsung flowImproper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows...5.7 Medium
- jenkinsMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins9.8 Critical
- publify project publify, publify core core +1 morePublify - Improper Authorization Leads to Guest Signup Restriction Bypass6.5 Medium
- optinmonsterOptinMonster <= 2.6.4 Unprotected REST-API Endpoints8.2 High
- atlassian jira server, jira data center +1 moreAffected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin...4.3 Medium
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow authenticated yet non...6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service7.2 High
- inhand networks ir615 router, inhandnetworks ir615 firmware +1 moreInHand Networks IR615 Router8.0 High
- huachu digital technology co.,ltd. easytest, huaju easytest online learning test platform +1 moreHuachu Digital Technology Co.,Ltd. Easytest - Improper Authorization4.3 Medium
- shinher information co., ltd. studyonline system, xinheinformation xinhe teaching platform system +1 moreShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-34.3 Medium
- shinher information co., ltd. studyonline system, xinheinformation xinhe teaching platform system +1 moreShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-25.4 Medium
- shinher information co., ltd. studyonline system, xinheinformation xinhe teaching platform system +1 moreShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-18.8 High
- minioBypassing policy restrictions on regular users8.8 High
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An...6.5 Medium
- accesspress themes accesspress-basic, accesspress-lite, accesspress-mag +41 more +43 moreAccessPress Themes - Authenticated Malicious File Upload8.8 High
- tad uploaderTad Uploader - Improper Authorization5.3 Medium
- tad tadtoolsTad TadTools - Improper Authorization7.5 High
- tad book3Tad Book3 - Improper Authorization9.1 Critical
- tad webTad Web - Improper Authorization5.3 Medium
- tad honorTad Honor - Improper Authorization5.3 Medium
- samsung galaxy storeIntent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to...7.1 High
- wire wire-serverAccount takeover when having only access to a user's short lived token in wire-server7.4 High
- wire, wireapp wire-ios +1 moreAccount takeover when having only access to a user's short lived token7.4 High
- google android, samsung mobile devices +1 moreAn improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep...4.0 Medium
- google android, samsung mobile devices +1 moreAn improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep...4.0 Medium
- palo alto networks cortex xsoarCortex XSOAR: Improper Authorization of Incident Investigations Vulnerability2.6 Low
- adobe magento commerce, magento +1 moreMagento Commerce improper authorization allows an authenticated user to perform certain functions without permission5.0 Medium
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution9.1 Critical
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure6.5 Medium
- johnson controls cem systems ac2000, johnsoncontrols ac2000 firmware +1 moreCEM Systems AC20008.2 High
- eclipse mosquitto, the eclipse foundation eclipse mosquitto, fedoraproject fedora +2 moreIn Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the...5.3 Medium
- adobe experience managerAdobe Experience Manager Improper Authorization at /content/usergenerated3.7 Low
github.com/argoproj/argo-workflowsGo,github.com/argoproj/argo-workflows/v2Go,github.com/argoproj/argo-workflows/v3Go +2 morePotential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`No score- lenovo smart camera x3, x5, and c2e firmware, smart camera c2e firmware, smart camera x3 firmware +1 more +3 moreA vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an...9.4 Critical
- microsoft onefuzzImproper Authorization and Origin Validation Error in OneFuzz10.0 Critical
- dell dbutil, dbutildrv2.sys firmware +1 moreDell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control...8.8 High
- Show moreLoading…