CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- palantir foundry comments, com.palantir.comments:comments +1 moreRetrieval of Attachments to Comments lacks Authorization6.5 Medium
- qualcomm 315 5g iot modem firmware, ar8035 firmware, fastconnect 6200 firmware +95 more +97 moreImproper authentication in Modem7.5 High
- qualcomm 315 5g iot modem firmware, 8953pro firmware, 9205 lte modem firmware +240 more +242 moreImproper authorization in Modem7.5 High
- vektor-inc vk blocksVK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update4.3 Medium
- vektor-inc vk blocksVK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreLow-privileged User can View Hashed Default Splunk Password4.3 Medium
- splunk, splunk cloud platform, enterprise +2 more‘edit_user’ Capability Privilege Escalation8.8 High
- splunk, splunk cloud platform, enterprise +2 moreRole-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results4.3 Medium
- kyvernoKyverno resource with a deletionTimestamp may allow policy circumvention6.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate...4.3 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreError in calendar when booking an appointment reveals the full path of the website2.6 Low
- open-emr openemr, openemr openemr/openemr +1 moreImproper Authorization in openemr/openemr6.3 Medium
- pomeriumIncorrect Authorization with specially crafted requests10.0 Critical
- granth go pricing - wordpress responsive pricing tables, granthweb go pricing +1 moreGo Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload7.1 High
- zulipUnauthorized user can register an account in specific configurations in Zulip6.5 Medium
- acronis cyber infrastructureSensitive information disclosure due to improper authorization. The following products are...5.5 Medium
- acronis agent, cyber protect 15, cyber protect +2 moreSensitive information disclosure and manipulation due to improper authorization. The following...5.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Software API Vulnerabilities5.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Software API Vulnerabilities5.4 Medium
- cisco catalyst center, digital network architecture center (dna center) +1 moreCisco DNA Center Software API Vulnerabilities5.4 Medium
- checkmkReading host_configs does not honour contact groups4.3 Medium
- rocket.chatAn improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to...6.5 Medium
- intel endpoint management assistant configuration tool, manageability commander +1 moreImproper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC...5.0 Medium
- intel endpoint management assistantImproper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an...5.0 Medium
- intel setup and configuration softwareImproper authorization in the Intel(R) SCS software all versions may allow an authenticated user...5.0 Medium
- microsoft visual studio codeVisual Studio Code Spoofing Vulnerability6.6 Medium
- rocket.chatA vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of...5.3 Medium
- rocket.chatA vulnerability has been discovered in Rocket.Chat, where editing messages can change the...5.3 Medium
- otrsInformation disclouse and DoS via websocket push events7.6 High
- samsung mobile core service, samsung core services +1 moreImproper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to...4.0 Medium
- milesight ms-n1004-uc firmware, ms-n1004-upc firmware, ms-n1008-uc firmware +23 more +25 moreImproper Authorization Vulnerability in Milesight Network Video Recorder (NVR)7.5 High
- oretnom23 service provider management systemSourceCodester Service Provider Management System improper authorization6.3 Medium
- modoboa, modoboa modoboa/modoboa +1 moreImproper Authorization in modoboa/modoboa9.1 Critical
- juniper junos os evolvedJunos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions7.1 High
- forgerock access managementImproper authorization that can lead to account impersonation9.8 Critical
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA user with non-Admin access can change a configuration file on the client to modify the Server URL.7.8 High
- hashicorp nomad, nomad enterprise +1 moreNomad Unauthenticated Client Agent HTTP Request Privilege Escalation10.0 Critical
- glpi-project glpiGLPI vulnerable to Privilege Escalation from Technician to Super-Admin8.8 High
- gitlabImproper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all...5.3 Medium
- hashicorp vault, vault enterprise +1 moreVault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata6.5 Medium
- hitachi energy sdm600SDM600 software privilege level7.5 High
- hitachi energy sdm600SDM600 API permission check4.8 Medium
- hitachi energy sdm600SDM600 API web services authorization validation7.7 High
- moodleMoodle may allow students to bypass sequential navigation during a quiz attempt4.3 Medium
- ciliumCilium vulnerable to potential network policy bypass when routing IPv6 traffic4.2 Medium
- nilsteampassnet nilsteampassnet/teampass, teampass +1 moreAuthorization Bypass Through User-Controlled Key in nilsteampassnet/teampass6.3 Medium
- aveva plant scada, telemetry server +1 moreCVE-2023-12569.8 Critical
- samsung android, samsung mobile devices +1 moreImproper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar...4.0 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical...2.4 Low
- samsung android, samsung mobile devices +1 moreImproper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to...3.3 Low
- Show moreLoading…