CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- dedecmsDedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.9.1 Critical
- motorola phonesA PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application...6.1 Medium
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View showUsers Improper Authorization Privilege Escalation Vulnerability8.8 High
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View showUser Improper Authorization Privilege Escalation Vulnerability8.8 High
- edge22 wp show postsWP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure4.3 Medium
- carinaAn RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute...6.9 Medium
- milesight ur32l, ur32l firmware +1 moreA firmware update vulnerability exists in the luci2-io file-import functionality of Milesight...8.8 High
- danswer-ai danswerUnauthorized access to GET/SET of Slack Bot Tokens in Danswer9.8 Critical
- qnap qts, quts hero +1 moreQTS, QuTS hero7.4 High
- red hat a-mq clients 2, cryostat 2, openshift serverless +9 more +11 moreQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.6.5 Medium
- fedoraproject sssd, fedora, red hat enterprise linux 6 +29 more +31 moreSssd: race condition during authorization leads to gpo policies functioning inconsistently7.1 High
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed...7.5 High
- openfgaOpenFGA Authorization Bypass8.1 High
- oracle corporation complex maintenance, repair, and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E...6.1 Medium
- oracle corporation complex maintenance, repair, and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E...6.1 Medium
- oracle corporation complex maintenance, repair, and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E...6.1 Medium
- oracle corporation complex maintenance, repair, and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E...6.1 Medium
- oracle corporation complex maintenance, repair, and overhaul, oracle complex maintenance repair and overhaul +1 moreVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E...6.1 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload6.4 Medium
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary9.1 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.3 - Insecure Direct Object Reference6.5 Medium
- microsoft azure migrateAzure Migrate Remote Code Execution Vulnerability6.4 Medium
- huawei emui, harmonyos +1 moreVulnerability of permission verification in some APIs in the ActivityTaskManagerService module....7.5 High
- huawei emui, harmonyos +1 morePermission verification vulnerability in the Settings module. Impact: Successful exploitation of...7.5 High
- cp plus wi-fi cameraCP Plus Wi-Fi Camera User Management improper authorization5.4 Medium
- nodejs undici, fedoraproject fedora +1 moreUndici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline3.9 Low
- oretnom23 computer laboratory management systemSourceCodester Computer Laboratory Management System save_users improper authorization5.4 Medium
- teledyne flir ax8, flir ax8 firmware +1 moreTeledyne FLIR AX8 User Registration test_login.php improper authorization5.3 Medium
- nvidia virtual gpu manager, vgpu driver, cloud gaming driver +1 moreCVE7.8 High
- cisco catalyst center, digital network architecture center (dna center) +1 moreA vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco...4.3 Medium
- delta electronics diaenergieClient-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie8.8 High
- jupyter oauthenticatorGoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace7.5 High
- ruijie rg-nbs2009g-p, rg-nbs2009g-p firmware +1 moreRuijie RG-NBS2009G-P Password passwdManage.htm improper authorization5.3 Medium
- glpi-project glpiSensitive fields access through dropdowns in GLPI6.5 Medium
- glpi-project glpiglpi Users emails enumeration6.5 Medium
- kishor-23 food waste management systemkishor-23 Food Waste Management System admin.php improper authorization5.3 Medium
- fortinet fortiportalAn improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0...3.9 Low
- bdtask hospital automanagerBdtask Hospital AutoManager Prescription Page improper authorization3.8 Low
- lfprojects minder`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user7.1 High
- hikvision hikcentral professionalDue to insufficient server-side validation, a successful exploit of this vulnerability could...7.5 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway, secure connect gateway policy manager +2 moreDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization...5.8 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- ampforwp accelerated mobile pages, mohammed kaludi amp for wp – accelerated mobile pages +1 moreAMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data6.5 Medium
- oracle mysql, oracle corporation mysql server +1 moreVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle knowledge managementVulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component:...5.4 Medium
- netapp snapcenterImproper Authorization Vulnerability in SnapCenter5.4 Medium
- intel pm software, performance maximizer +1 moreImproper authorization in some Intel(R) PM software may allow a privileged user to potentially...6.7 Medium
- microsoft 365 apps, 365 apps for enterprise +1 moreMicrosoft Outlook Elevation of Privilege Vulnerability7.1 High
- pixelfedInsufficient authorization allowing elevated access to resources in pixelfed9.9 Critical
- emerson rosemount gc370xa, gc1500xa firmware, gc370xa firmware +3 more +5 moreEmerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization6.9 Medium
- Show moreLoading…