CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- samsung emailIntent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70...6.2 Medium
- samsung galaxy wearableImplicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows...4.0 Medium
- kromit titra, kromitgmbh kromitgmbh/titra +1 moreImproper Authorization in kromitgmbh/titra9.8 Critical
- artica pfms pandora fms, pandora fms fms +1 moreImproper Authorization in User Management to Vertical Privilege Escalation7.3 High
- pega infinity, pegasystems pega infinity +1 morePassword authentication bypass vulnerability for local accounts can be used to bypass local...9.8 Critical
- zulipZulip Server insufficient authorization for changing bot roles5.4 Medium
- [unknown] pki-core, redhat certificate system, enterprise linux +2 moreA flaw was found in pki-core, which could allow a user to get a certificate for another user...5.7 Medium
- humhub calendarInformation exposure in Calendar prior to version 12.3.05.10000 allows attacker to access...3.3 Low
- samsung cloudImplicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker...7.5 High
- samsung cameraIntent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12...5.3 Medium
- google android, samsung mobile devices +1 moreImproper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local...6.2 Medium
- google android, samsung mobile devices +1 moreImproper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain...4.0 Medium
- apache shiroAuthentication Bypass Vulnerability9.8 Critical
- adobe robohelp, robohelp server +1 moreEscalate Privileges to Server Admin - Robohelp Server8.8 High
- samsung mobile smart things, samsung smartthings +1 moreMissing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access...7.5 High
- samsung passImproper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess...4.6 Medium
- google android, samsung mobile devices +1 moreImplicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows...6.2 Medium
- google android, samsung mobile devices +1 moreImproper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications...4.0 Medium
- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System New User Creation improper authorization7.3 High
- discourseInvite bypasses user approval in Discourse2.6 Low
- bigbluebuttonImproper access control for pencil annotations in BigBlueButton4.3 Medium
- bigbluebuttonGrace period for lock settings in public/private chats in BigBlueButton4.3 Medium
- bigbluebuttonImproper access control for breakout rooms in BigBlue Button4.3 Medium
- apple itunes, itunes for windows +1 moreA logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4...7.1 High
- dell openmanage enterpriseDell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization...9.0 Critical
- spring security, vmware spring security, netapp active iq unified manager +1 more +3 moreAuthorization bypass in Spring Security9.8 Critical
- hcl sametimeHCL Sametime is vulnerable to an information disclosure7.1 High
- palo alto networks cortex xsoarCortex XSOAR: Incorrect Authorization Vulnerability When Generating Reports4.3 Medium
- mozilla thunderbirdThe parent process would not properly check whether the Speech Synthesis feature is enabled, when...6.5 Medium
- suse rancherWrite access to the Catalog for any user when restricted-admin role is enabled5.4 Medium
- suse rancherPrivilege escalation for users with create/update permissions in Global Roles7.2 High
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Improper Authorization8.8 High
- siteground security, security optimizer – the all-in-one protection plugin +1 moreSiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass8.1 High
- samsung galaxy storeImproper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker...5.9 Medium
- phpipam, phpipam phpipam/phpipam +1 moreImproper Authorization in phpipam/phpipam6.5 Medium
- janeczku calibre-web, janeczku/calibre-web +1 moreImproper Authorization in janeczku/calibre-web4.3 Medium
- cobbler cobbler/cobbler, cobbler project cobbler, fedoraproject fedora +2 moreImproper Authorization in cobbler/cobbler8.2 High
- orchardcms orchardcms/orchardcore, orchardcore +1 moreImproper Authorization in orchardcms/orchardcore7.1 High
- salesagility salesagility/suitecrm, suitecrm +1 moreMissing Authorization in salesagility/suitecrm5.4 Medium
- webmin, webmin webmin/webmin +1 moreImproper Authorization in webmin/webmin5.4 Medium
- chocobozzz chocobozzz/peertube, framasoft peertube +1 moreMissing Authorization in chocobozzz/peertube5.4 Medium
- airspan networks mmp, ptmp c-series and a5x, ptp c-series +5 more +7 moreAirspan Networks Mimosa Improper Authorization10.0 Critical
- librenms, librenms librenms/librenms +1 moreImproper Authorization in librenms/librenms7.1 High
- samsung link sharingImproper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers...4.0 Medium
- ping identity pingfederatePing Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows5.3 Medium
- acronis agent, cyber protect 15, cyber protect home office +3 more +5 moreLocal privilege escalation via named pipe due to improper access control checks7.8 High
- arista eosAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users…9.1 Critical
- arista eosAn issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.9.1 Critical
- arista terminattrAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users…9.1 Critical
- samsung galaxy storeImproper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app...7.5 High
- Show moreLoading…