CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- ivanti epmm, endpoint manager mobile +1 moreAn insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an...9.8 Critical
- yonle bostrBostr Improper Authorization4.6 Medium
- apple macosThe issue was addressed with improved restriction of data container access. This issue is fixed...5.5 Medium
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...7.1 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6, macOS...5.5 Medium
- 202ecommerce paypalPayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...4.9 Medium
- oracle mysql, mysql server +1 moreVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...5.9 Medium
- oracle mysql, oracle corporation mysql server +1 moreVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...4.9 Medium
- elinksmart smart cabinet lockeLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform...7.3 High
- opensearch observabilityOpenSearch Observability does not properly restrict access to private tenant resources4.2 Medium
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.1 +1 moreMicrosoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability7.3 High
- sap se commerce, sap commerce cloud, commerce hycom +2 more[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce7.2 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMissing authorization check may lead to shard key refinement5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server improper authentication3.3 Low
- goauthentik authentikInsufficient access control for OAuth2 Device Code flow in authentik8.6 High
- elastic cloud enterpriseIt was identified that under certain specific preconditions, an API key that was originally...8.1 High
- gitlabImproper Authorization in GitLab6.5 Medium
- enalean tuleapTuleap has improper permissions of the backlog items4.3 Medium
- ibm storage protect for virtual environments: data protection for vmware, storage protect for virtual environments +1 moreIBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass7.7 High
- fooevents, fooevents for woocommerce +1 moreFooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload7.1 High
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Authorization (CWE-285)8.2 High
- hashicorp vault, vault enterprise +1 moreVault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims2.6 Low
- dell networking os10, smartfabric os10 software, smartfabric os10 +2 moreDell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an...8.8 High
- lunary, lunary-ai lunary-ai/lunary +1 moreIncorrect Authorization in lunary-ai/lunary9.8 Critical
typo3/cmsPackagistTYPO3 Broken Access Control in Localization Handling6.5 Medium- evmosEvmos allows unvested token delegations5.3 Medium
- evmosEvmos is missing create validator check3.5 Low
- evmosEvmos is missing precompile checks3.5 Low
- evmosevmos allows transferring unvested tokens after delegations3.5 Low
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreImproper Authorization in mintplex-labs/anything-llm9.1 Critical
- kanboardKanboard affected by Project Takeover via IDOR in ProjectPermissionController8.2 High
typo3/cmsPackagistInformation Disclosure in TYPO3 Backend5.3 Medium- gradio-app gradio-app/gradio, gradio project gradio +1 moreSecrets Exfiltration in gradio-app/gradio7.1 High
- fortinet fortiwebMultiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below,...5.6 Medium
- fortinet fortiwebmanager, fortiweb manager +1 moreAn improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6...7.6 High
- fortinet fortiwebmanager, fortiweb manager +1 moreAn improper authorization in Fortinet FortiWebManager version 7.2.0 and 7.0.0 through 7.0.4 and 6...7.6 High
- casgateMultiple Broken Function-Level Authorization vulnerabilities in casgate9.8 Critical
- wp chill download monitorDownload Monitor <= 4.9.13 - Missing Authorization5.4 Medium
- canonical snapdCVE-2024-5138: snapd snapctl auth bypass8.1 High
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual4.3 Medium
friendsofsymfony/user-bundlePackagistFOSUserBundle User Identity Validation VulnerabilityNo scoreezsystems/ezpublish-legacyPackagisteZ Publish Legacy Passwordless login for LDAP usersNo score- cyberpower powerpanel, powerpanel business +1 moreCyberPower PowerPanel business Incorrect Authorization6.5 Medium
- yith woocommerce gift cards, yithemes yith woocommerce gift cards +1 moreYITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update5.3 Medium
- craftcms commerce, hcltechsw hcl commerce +1 moreHCL Commerce is potentially affected by a denial of service and information disclosure vulnerability7.1 High
- cryptopp crypto\+\+A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of...9.8 Critical
- campcodes online laundry management systemCampcodes Online Laundry Management System admin_class.php improper authorization5.3 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp vikbooking hotel booking engine \& pms +1 moreVikBooking < 1.6.8 - Insecure Direct Object References8.1 High
- totolink ex1800t firmwareTOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter...9.8 Critical
- Show moreLoading…