CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- openobserveOpenObserve Privilege Escalation Vulnerability in Users API10.0 Critical
- openobserveOpenObserve Unauthorized Access Vulnerability in Users API9.1 Critical
- gitlabIncorrect Authorization in GitLab6.5 Medium
- hid global iclass se reader configuration cards, omnikey secure elements reader configuration cards, hidglobal iclass se reader configuration cards firmware +1 more +3 moreHID Global Reader Configuration Cards Improper Authorization5.3 Medium
- veeam recovery orchestrator, availability orchestrator, disaster recovery orchestrator +2 moreVulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role...6.5 Medium
- hid global iclass se cp1000 encoder, iclass se processors, iclass se reader modules +13 more +15 moreInsecure Default Initialization of Resource in HID Global5.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint...4.3 Medium
- qnap qts, qutscloud, qnap systems inc. quts hero +2 moreQTS, QuTScloud5.0 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- join-lemmy lemmyAny authenticated user may obtain private message details from other users on the same instance7.5 High
- drupal open socialOpen Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-0059.1 Critical
- ibm openpages with watsonIBM OpenPages with Watson privilege escalation8.8 High
- oracle bi publisher, oracle corporation bi publisher (formerly xml publisher) +1 moreVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). ...5.4 Medium
- evershopEverShop vulnerable to improper authorization in GraphQL endpoints7.5 High
- apolloconfig apolloApollo Configuration Center users improper authorization4.3 Medium
- leechesnutt slick social share buttonsSlick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update8.8 High
- freeamigos manage notification e-mailsManage Notification E-mails <= 1.8.5 - Missing Authorization5.3 Medium
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app...5.5 Medium
- bosch nexo-os, rexroth nexo cordless nutrunner nxa011s-36v (0608842011), nexo cordless nutrunner nxa011s-36v-b (0608842012) +18 more +20 moreThe vulnerability allows an authenticated remote attacker to perform actions exceeding their...8.8 High
- sap se s/4hana finance (advanced payment management), sap s\/4hana finance +1 moreMissing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)6.4 Medium
- sap lt replication serverImproper Authorization check in SAP LT Replication Server7.3 High
- misskeyMisskey vulnerable to improper authorization when accessing with third-party application9.1 Critical
- gitlabMissing Authorization in GitLab4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread...4.3 Medium
- fortinet fortiadcAn improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7...6.9 Medium
- hitachi vantara system management unit (smu), hitachi system management unit firmware +1 moreSystem Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuratio…7.6 High
- hitachi vantara system management unit (smu), system management unit, hitachi vantara hitachi network attached storage +2 moreSystem Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configurat…7.6 High
- nextauth.js next-authnext-auth vulnerable to possible user mocking that bypasses basic authentication5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service7.5 High
- palantir video-application-server, com.palantir.video:video-application-server +1 moreGotham Video Broken Authentication2.7 Low
- intel quickassist technology firmware, quickassist technology library +1 moreImproper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2...6.7 Medium
- intel battery life diagnostic toolImproper authorization in some Intel Battery Life Diagnostic Tool installation software before...6.7 Medium
- fortinet fortimailAn improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2...5.3 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)4.3 Medium
- prestashop blockreassurance, customer reassurance block +1 morePrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block5.5 Medium
- samsung push serviceImproper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10...4.0 Medium
- qualcomm 315 5g iot modem firmware, 9205 lte modem firmware, aqt1000 firmware +224 more +226 moreImproper Authorization in HLOS7.1 High
- teamamaze teamamaze/amazefileutilities, amaze file utilities +1 moreImproper Authorization in teamamaze/amazefileutilities8.2 High
- busbaer eisbaer scada, eisbaer scada scada +1 moreEisBaer Scada - CWE-285: Improper Authorization8.8 High
- radykal fancy product designerFancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options8.8 High
- brizy, themefusecom brizy – page builder +1 moreBrizy < 1.0.126 - Authorization Bypass to Settings Updates7.4 High
- radykal fancy product designerFancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions6.3 Medium
- meta react developer tools extension, facebook react-devtools +1 moreReact Developer Tools extension Improper Authorization vulnerability6.5 Medium
- adobe commerce, magento +1 moreFull page cache enumeration via cookie X-Magento-Vary7.5 High
- fortinet fortiosAn improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4...7.4 High
- garuda linux linux, garudalinux garuda linux +1 moreGaruda Linux Improper Authorization5.3 Medium
- helpdezk, helpdezk community +1 moreHelpDezk Community improper authorization8.6 High
- samsung assistantImproper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows...4.4 Medium
- gitlabMissing Authorization in GitLab3.1 Low
- cisco ios xe software, ios, ios xe +2 moreA vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS...8.0 High
- Show moreLoading…