CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- google android, samsung mobile devices +1 moreImplicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1...4.0 Medium
- samsung exynos firmware, samsung mobile devices +1 moreImproper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker...6.5 Medium
- quarkusQuarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed7.5 High
- facepay project facepayFacepay camera.php authorization6.3 Medium
- microsoft device-mapper-multipath, redhat enterprise linux +1 moreA vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows...7.8 High
- samsung billingImproper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get...6.2 Medium
- google android, samsung mobile devices +1 moreImproper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1...4.0 Medium
- google android, samsung mobile devices +1 moreImproper authorization vulnerability in?CallBGProvider prior to SMR Nov-2022 Release 1 allows...5.9 Medium
- discourseDiscourse user account takeover via email and invite link8.9 High
- sick flx3-cpuc1 firmware, flx3-cpuc2 firmware +1 moreA remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact...9.1 Critical
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreProfile of disabled user stays accessible3.5 Low
- openfgaOpenFGA Authorization Bypass5.9 Medium
- openfgaOpenFGA Authorization Bypass5.9 Medium
- openfgaOpenFGA Information Disclosure5.3 Medium
- mitel micollabA vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an...6.5 Medium
- mitel micollabA vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow...8.8 High
- keystonejs keystone@keystone-6/core vulnerable to field-level access-control bypass for multiselect field9.1 Critical
- wolfsslAn issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer...5.3 Medium
- dell cloud mobility for dell storage, cloud mobility for dell emc storage +1 moreCloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control...6.7 Medium
- apache airflowSession still functional after user is deactivated8.1 High
- samsung internetImproper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows...4.3 Medium
- samsung dynamic lockscreen, samsung mobile devices +1 moreImproper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and...5.3 Medium
- bytebasebytebase - Improper Authorization4.3 Medium
- bytebasebytebase - Improper Authorization4.3 Medium
- harborHarbor fails to validate the user permissions when updating a robot account6.4 Medium
- harborHarbor fails to validate the user permissions when updating tag immutability policies6.4 Medium
- harborHarbor fails to validate user permissions while Viewing, updating and deleting Webhook policies7.7 High
- harborHarbor fails to validate the user permissions when updating tag retention policies7.7 High
- hitachi energy microscada x sys600A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.8.5 High
- harborHarbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs7.4 High
- gravitl netmakerNetmaker vulnerable to Insufficient Granularity of Access Control8.8 High
- samsung photo editor, google android, samsung mobile devices +2 moreImproper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows...1.9 Low
- google android, samsung mobile devices +1 moreImproper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local...1.9 Low
- samsung pay, pay kr +1 morePending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63...5.0 Medium
- google android, samsung mobile devices +1 moreImproper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1...5.1 Medium
- samsung pay, pay kr +1 morePending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63...5.0 Medium
- samsung pay, pay kr +1 morePending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to...5.0 Medium
- samsung passImproper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical...1.8 Low
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users8.1 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference7.1 High
- suse rancherRancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)9.1 Critical
- oferwald transposh wordpress translation, transposh wordpress translation +1 moreTransposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change5.3 Medium
- chatwoot, chatwoot chatwoot/chatwoot +1 moreImproper Authorization in chatwoot/chatwoot7.6 High
- cisco aci multi-site orchestrator, aci multi-site orchestrator software +1 moreCisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability8.8 High
- apple ipados, macos, iphone os +1 more +3 moreA logic issue was addressed with improved state management. This issue is fixed in macOS Monterey...5.5 Medium
- sequi portbloque s, portbloque s firmware +1 moreSequi PortBloque S Improper Authorization9.9 Critical
- adobe commerce, magento commerce, magento +2 moreAdobe Commerce Improper Authorization Privilege escalation7.5 High
- nvidia virtual gpu, virtual gpu software and nvidia cloud gaming +1 moreNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it...7.8 High
- unitree go 1, go 1 firmware +1 moreUnitree Go 1 "Robot Dog" Unauthenticated Remote Power Down6.5 Medium
- google android, samsung mobile devices +1 moreImplicit Intent hijacking vulnerability in Smart View prior to SMR Aug-2022 Release 1 allows...4.0 Medium
- Show moreLoading…