CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- dell cpg bios, inspiron 14 plus 7420 firmware, inspiron 14 plus 7620 firmware +73 more +75 moreDell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker...4.6 Medium
- wallabag, wallabag wallabag/wallabag +1 moreImproper Authorization in wallabag/wallabag7.3 High
- kylinsoft kylin-activation, kylinos kylin os +1 moreKylinSoft kylin-activation File Import improper authorization8.4 High
- cisco finesse, unified contact center enterprise +1 moreCisco Finesse Reverse Proxy VPN-less Access to Finesse Desktop Denial of Service Vulnerability5.3 Medium
- fortinet fortiwebAn unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0...6.6 Medium
- pixelfed, pixelfed pixelfed/pixelfed +1 moreImproper Authorization in pixelfed/pixelfed4.3 Medium
- delta electronics diaenergieImproper Authorization8.8 High
- fortinet fortinac, fortinac-f +1 moreAn improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4...8.6 High
- splunk, splunk enterprise, cloud platform +2 morePermissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise4.3 Medium
- splunk, splunk enterprise, cloud platform +2 more‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise4.3 Medium
- dell powerpath management appliancePowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass...8.8 High
- samsung android, samsung mobile devices +1 moreImproper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1...6.2 Medium
- samsung android, samsung mobile devices +1 moreImproper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to...3.3 Low
- samsung galaxy storeImproper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local...7.8 High
- samsung smart thingsImproper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to...4.2 Medium
- samsung android, samsung mobile devices +1 moreImproper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to...4.0 Medium
- samsung android, samsung mobile devices +1 moreImproper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023...5.7 Medium
- dell command \| intel vpro out of band, command intel vpro out of band (dciv) +1 moreDell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization...7.0 High
- unified intents ab remote, unifiedremote unified remote +1 moreBecause the web management interface for Unified Intents' Unified Remote solution does not itself...9.8 Critical
- phpipam, phpipam phpipam/phpipam +1 moreMissing Authorization in phpipam/phpipam7.5 High
- sensiolabs symfonySymfony storing cookie headers in HttpCache5.9 Medium
- wallabag, wallabag wallabag/wallabag +1 moreImproper Authorization in wallabag/wallabag5.4 Medium
- wallabag, wallabag wallabag/wallabag +1 moreImproper Authorization in wallabag/wallabag6.5 Medium
- schneider electric ecostruxure power commissionA CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to...7.8 High
- schneider electric ecostruxure geo scada expert 2019 - 2021 (formerly known as clearscada), schneider-electric ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +1 more +3 moreA CWE-285: Improper Authorization vulnerability exists that could cause Denial of Service against...9.1 Critical
- suse rancherAuthenticated user can gain unauthorized shell pod and kubectl access in the local cluster7.4 High
- dell cpg drivers, realtek high definition audio driver +1 moreAn improper access control vulnerability was identified in the Realtek audio driver. A local...7.3 High
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to...6.5 Medium
- firefly-iii firefly-iii/firefly-iii, firefly iii +1 moreIncorrect Authorization in firefly-iii/firefly-iii6.5 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation4.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows SMB Witness Service Elevation of Privilege Vulnerability8.8 High
- fit2cloud kubeoperatorKubeOperator is vulnerable to unauthorized access to system API7.3 High
- jvvlee merlinsboardjvvlee MerlinsBoard Grade improper authorization3.5 Low
- forged alliance forever project alliance foreverForged Alliance Forever Vote improper authorization4.6 Medium
- froxlor, froxlor froxlor/froxlor +1 moreImproper Authorization in froxlor/froxlor6.5 Medium
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.3 High
- usememos memos, usememos/memos +1 moreImproper Authorization in usememos/memos8.2 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos9.1 Critical
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.6 High
- huawei aslan-al10, aslan-al10 firmware +1 moreHuawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit...5.5 Medium
- usememos memos, usememos/memos +1 moreImproper Authorization in usememos/memos8.8 High
- dataprobe iboot-pdu fw, iboot-pdu4-n20 firmware, iboot-pdu4a-n15 firmware +10 more +12 moreDataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP...5.3 Medium
- openfgaOpenFGA Authorization Bypass7.7 High
- huawei emui, harmonyos +1 moreThe application management module has a vulnerability in permission verification. Successful...7.5 High
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate Browser Extension Provisioning improper authorization5.0 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate API authorization4.3 Medium
- oferwald transposh wordpress translation, transposh wordpress translation +1 moreTransposh WordPress Translation <= 1.0.9.6 - Authorization Bypass5.3 Medium
- fp newsletter project newsletterAn issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension...9.1 Critical
- Show moreLoading…