CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- apache traffic controlApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments9.9 Critical
- qianfox foxcmsFoxCMS API Endpoint Site.php improper authorization6.9 Medium
- dani-garcia vaultwardenPrivilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden7.6 High
- fujifilm business innovation apeos c3070, apeos c5570, apeos c6580 +2 moreFujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization6.9 Medium
- codename065 download managerDownload manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files5.3 Medium
- vercel next.jsAuthorization bypass in Next.js7.5 High
github.com/ryanbekhen/nanoproxyGoPotential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxyNo score- apache supersetApache Superset: SQLLab Improper readonly query validation allows unauthorized write access7.1 High
- dromara ujcmsDromara UJCMS User ID id authorization6.3 Medium
github.com/kcp-dev/kcpGokcp's impersonation allows access to global administrative groups6.4 Medium- golang.org/x/crypto golang.org/x/crypto/sshMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto9.1 Critical
- adobe experience managerAdobe Experience Manager | Improper Authorization (CWE-285)6.5 Medium
- adobe experience managerAdobe Experience Manager | Improper Authorization (CWE-285)4.3 Medium
- apache supersetApache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled7.6 High
- erzhongxmu jeewmsGuangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization6.9 Medium
- mayurik best house rental management systemSourceCodester Best House Rental Management System POST Request ajax.php improper authorization6.9 Medium
- red hat enterprise linux 8, enterprise linux 9, openshift container platform 3.11 +5 more +7 moreCri-o: checkpoint restore can be triggered from different namespaces7.4 High
- tyche softwares booking & appointment plugin for woocommerce, tychesoftwares booking and appointment plugin for woo commerce +1 moreBooking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update8.8 High
- goauthentik authentikauthentik performs insufficient validation of OAuth scopes6.4 Medium
- moodleMoodle: lesson activity password bypass through php loose comparison5.4 Medium
- moodleMoodle: unprotected access to sensitive information via dynamic tables6.5 Medium
- cisco data center network manager, prime data center network manager +1 moreCisco Data Center Network Manager Authorization Bypass Vulnerability6.3 Medium
- moodleMoodle: idor when fetching report schedules4.3 Medium
- moodleMoodle: idor in edit/delete rss feed4.3 Medium
- altenergy power control softwareAltenergy Power Control Software database improper authorization6.9 Medium
- glpi-project glpiGLPI allows API document download without rights5.3 Medium
- budgetcontrol gatewayAuth Token can be passed dummy or wrong the middleware response is 200 OK9.3 Critical
- dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 moreImproper Authorization in dolibarr/dolibarr4.3 Medium
- harborUser permission validation failure and disclosure of P2P preheat execution logs7.4 High
- jenkins project pipeline: declarative plugin, jenkins pipeline\, jenkins project pipeline declaratrive plugin +2 moreRestarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin8.0 High
- jenkins groovy, jenkins project pipeline: groovy plugin, jenkins pipeline\ +2 moreRebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin8.0 High
- microsoft azure cyclecloud, azure cyclecloud 8.0.0, azure cyclecloud 8.0.1 +12 more +14 moreAzure CycleCloud Remote Code Execution Vulnerability9.9 Critical
- mayurik hospital management systemSourceCodester Hospital Management System delete-account.php improper authorization5.3 Medium
- huawei harmonyosPermission control vulnerability in the clipboard module Impact: Successful exploitation of this...6.2 Medium
- totolink lr350, lr350 firmware +1 moreTOTOLINK LR350 formLoginAuth.htm authorization6.9 Medium
- jinher oa, tongda oa 2017, tongda2000 office anywhere +2 moreTongda OA Annual Leave data.php improper authorization6.9 Medium
- kyvernoKyverno's PolicyException objects can be created in any namespace by default8.7 High
- spring, spring webflux +1 moreAuthorization Bypass of Static Resources in WebFlux Applications9.1 Critical
- mapster wp mapsMapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update8.8 High
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending4.3 Medium
- woocommerce smart couponsWooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation5.3 Medium
- sakailms sakaiSakai: Kernel users created with type roleview can login as a normal user8.7 High
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans8.8 High
- gradio-app gradioCORS origin validation accepts the null origin in Gradio6.9 Medium
- gradio-app gradioCORS origin validation is not performed when the request has a cookie in Gradio6.9 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.4 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)6.5 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.4 Medium
- surrealdbSurrealDB before 2.0.4 Improper Authorization via SELECT Permissions7.1 High
- microsoft windows server 2022, 23h2 edition (server core installation), windows server 2022 23h2 +1 moreWindows Kerberos Elevation of Privilege Vulnerability7.5 High
- Show moreLoading…