CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- google android, lg electronics v60 thin q 5g(lmv600vm) +1 morePersonalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking6.1 Medium
- google android, lg electronics v60 thin q 5g(lmv600vm) +1 moreBluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking6.1 Medium
- redhat apicast, red hat 3scale api management platform 2 +1 moreApicast proxies the api call with incorrect jwt token to the api backend without proper authorization check7.4 High
- acronis cyber protect 15, cyber protect +1 moreSensitive information disclosure and manipulation due to improper authorization. The following...4.6 Medium
- element-hq synapse, fedoraproject fedora +1 moreImproper validation of receipts allows forged read receipts in matrix synapse3.1 Low
- dell networkerDell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client...8.8 High
- ormazabal ekorccp, ekorrci, ekorccp firmware +1 more +3 moreImproper Authorization in Ormazabal products8.6 High
- redhat network observability, red hat network-observability-1.1.0-rhel-8 +1 moreNetwork-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced7.5 High
- samsung cameraImplicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12...3.3 Low
- samsung packageinstallerchnIntent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local...4.4 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR...4.6 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to...7.5 High
- qualcomm 205 firmware, 215 firmware, 9206 lte firmware +80 more +82 moreImproper Authorization in WLAN Host7.5 High
- qualcomm 205 firmware, 215 firmware, 9206 lte firmware +109 more +111 moreImproper Authorization in WLAN Host7.5 High
- qualcomm aqt1000 firmware, csrb31024 firmware, fastconnect 6200 firmware +70 more +72 moreImproper Authorization in WLAN Host7.5 High
- zulip, zulip server +1 moreZulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers6.5 Medium
- enalean tuleapTuleap allows preview of a linked artifact with a type does not respect permissions6.5 Medium
- redhat subscription-manager, fedoraproject fedora, red hat enterprise linux 6 +30 more +32 moreSubscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration7.8 High
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- huawei emui, harmonyos +1 moreParameter verification vulnerability in the installd module. Successful exploitation of this...9.1 Critical
- intel nuc pro software suite, next unit of computing firmware +1 moreImproper authorization in the Intel(R) NUC Pro Software Suite for Windows before version 2.0.0.9...8.2 High
- samsung internetImproper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows...3.8 Low
- hashicorp consul, consul enterprise +1 moreJWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access7.4 High
- full - customer, fullservices full – cliente +1 moreFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation8.8 High
- sap message serverImproper Authorization check vulnerability in SAP Message Server7.5 High
- navneil naicker acf photo gallery fieldACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update4.3 Medium
- getsentry sentrySentry vulnerable to improper authorization on debug and artifact file downloads7.7 High
- gallagher command centreImproper privilege validation in Command Centre Server allows authenticated unprivileged...4.3 Medium
- gallagher command centreCompetency access levels not enforced in the server7.1 High
- gallagher command centreImproper privilege validation in Command Centre Server allows authenticated operators to modify...7.6 High
- four-faith video surveillance management systemXiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorization7.3 High
- dell wyse management suiteWyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An...4.9 Medium
- pimcore customer-data-framework, pimcore/customer-data-framework, customer management framework +2 moreImproper Authorization in pimcore/customer-data-framework6.3 Medium
- nvidia vgpu software, gpu display driver +1 moreNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a...7.1 High
- ovarro tbox lt2, tbox ms-cpu32, tbox rm2 +7 more +9 moreThe affected TBox RTUs allow low privilege users to access software security tokens of higher...6.5 Medium
- tauriTauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles4.8 Medium
- teamviewer remoteAn improper authorization check of local device settings in TeamViewer Remote between version 15...6.6 Medium
- microsoft sharepoint server, sharepoint server 2019, sharepoint server subscription edition +2 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability6.5 Medium
- microsoft windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 +5 more +7 moreWindows Server Service Security Feature Bypass Vulnerability7.6 High
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint4.3 Medium
- ptc vuforia studioPTC Vuforia Studio Improper Authorization6.2 Medium
- ptc vuforia studioPTC Vuforia Studio Improper Authorization1.8 Low
- 2j-slideshow slideshow, image slider by 2j, 2joomla 2j slideshow +1 moreSlideshow, Image Slider by 2J <= 1.3.31 - Authorization Bypass5.4 Medium
- galleryape gallery images apeGallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation7.6 High
- najeebmedia frontend file manager pluginFrontend File Manager <= 18.2 - Privilege Escalation6.4 Medium
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce <= 1.2.6 - Missing Authorization7.5 High
- Show moreLoading…