CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- qualcomm fastconnect 6900 firmware, fastconnect 7800 firmware, sm7435 firmware +22 more +24 moreImproper Authorization in Performance6.1 Medium
- parse community server, parse-community parse-server +1 moreParse Server's custom object ID allows to acquire role privileges8.1 High
- zabbixAuthentication privilege escalation via user groups due to missing authorization checks7.5 High
- cisco nexus dashboard, nexus dashboard fabric controller, data center network manager +2 moreCisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability5.7 Medium
- cisco small business rv series router firmware, rv340 dual wan gigabit vpn router firmware, rv340w dual wan gigabit wireless-ac vpn router firmware +2 more +4 moreCisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation Vulnerability8.8 High
- oretnom23 railway reservation system, sourcecodester online railway reservation system +1 moreSourceCodester Online Railway Reservation System admin improper authorization5.3 Medium
- cisco ios xe software, ios, ios xe +2 moreA vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow...6.5 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop User Creation Users.php improper authorization5.3 Medium
- authzed spicedbMultiple caveats on resources of the same type can result in no permission when permission is expected3.7 Low
- microsoft dynamics 365 business central, dynamics 365 business central online +1 moreDynamics 365 Business Central Elevation of Privilege Vulnerability8.1 High
- opendaylight aaa, authentication\, authorization and accounting +1 moreOpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability7.5 High
- opendaylight md-sal, model-driven service abstraction layer +1 moreOpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries6.5 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 moreAutomation-controller: gain access to the k8s api server via job execution with container group6.6 Medium
- cisco network services orchestrator, ios xr software, small business rv series router firmware +1 more +3 moreCisco Network Services Orchestrator Configuration Update Authorization Bypass Vulnerability8.8 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +14 more +16 moreWindows Remote Desktop Licensing Service Denial of Service Vulnerability6.5 Medium
- microsoft outlook, outlook for ios +1 moreMicrosoft Outlook for iOS Information Disclosure Vulnerability6.5 Medium
- bareosBareos's negative command ACLs can be circumvented by abbreviating commands8.8 High
- profelis passboxImproper Authentication in Profelis Informatics and Consulting's PassBOX7.1 High
- red hat migration toolkit for virtualization 2.6Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication7.5 High
- cisco expressway-e, telepresence video communication server (vcs) expressway +1 moreCisco Expressway Edge Improper Authorization Vulnerability4.3 Medium
- huawei emui, harmonyos +1 moreAccess control vulnerability in the SystemUI module Impact: Successful exploitation of this...4.3 Medium
- onesoft-sudo sudobotSudoBot missing authorization check in `-config` command8.8 High
- bpl pws-01-btBPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in...5.1 Medium
- fluentforms contact form, techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder +1 moreContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification4.2 Medium
- open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 moreOpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability5.3 Medium
- in2code powermail, typo3 +1 morePowermail TYPO3 extension Broken Access Control in the OutputController9.8 Critical
- flowiseai flowiseFlowise Authentication Bypass9.8 Critical
- hyperledger fabricHyperledger Fabric does not verify request has a timestamp within the expected time window5.3 Medium
- goauthentik authentikauthentik has Insufficient Authorization for several API endpoints7.5 High
- oretnom23 yoga class registration systemSourceCodester Yoga Class Registration System Add User Users.php improper authorization5.3 Medium
- nissan altima, nissan-global blind spot detection sensor ecu firmware +1 moreUnauthorized access to ECU functionality5.3 Medium
- dylanjkotze zephyr project managerZephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation8.1 High
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System users.php improper authorization6.9 Medium
- adobe commerce, magento +1 moreA user without ship permissions can ship the orders4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)5.4 Medium
- adobe commerce, magento +1 moreAn unauthorized user can export the Invoiced Sales Report4.3 Medium
- adobe commerce, magento +1 moreAn unauthorized user can export the Shipping Report4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)4.3 Medium
- adobe commerce, magento +1 moreUnauthorized user can export Orders Sale Report4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)4.3 Medium
- adobe commerce, magento +1 moreA user without Shop Policy Parameters section privilege can alter the shop policy parameters section4.3 Medium
- adobe commerce, magento +1 moreAn unauthorized user can export the Tax Sales Report4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)4.3 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreBackup files may be downloaded by underprivileged users in MongoDB Enterprise Server5.3 Medium
- openfgaOpenFGA Authorization Bypass7.5 High
- huawei emui, harmonyos +1 moreAccess permission verification vulnerability in the Notepad module Impact: Successful...2.5 Low
- huawei emui, harmonyos +1 moreAccess permission verification vulnerability in the Contacts module Impact: Successful...4.4 Medium
- jenkinsJenkins does not perform a permission check in an HTTP endpoint6.3 Medium
- alien technology alr-f800, alientechnology alr-f800 firmware +1 moreAlien Technology ALR-F800 cmd.php improper authorization6.9 Medium
- Show moreLoading…