CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- netscout ngeniusoneNETSCOUT nGeniusONE before 6.4.0 b2350 has a Broken Authorization Schema for the report module.7.5 High
- miraheze managewikiManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions4.6 Medium
- yiiot xy-3820 firmwareYi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function...9.8 Critical
- nats-io nats-serverNATS-Server Fails to Authorize Certain Jetstream Admin APIs9.6 Critical
- code-projects studentmanagerZeroWdd/code-projects studentmanager getTeacherList improper authorization5.3 Medium
- code-projects db-hospital-drugJamesZBL/code-projects db-hospital-drug ShiroConfig.java improper authorization5.3 Medium
- veal98 小牛肉 echo 开源社区系统veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization5.3 Medium
- code-projects studentmanagerhuanfenz/code-projects StudentManager Teacher String improper authorization5.3 Medium
- wowjoy 浙江湖州华卓信息科技有限公司 internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization5.3 Medium
- code-projects employee management systemTutorials-Website Employee Management System update-user.php improper authorization6.9 Medium
- code-projects employee management systemTutorials-Website Employee Management System delete-user.php improper authorization6.9 Medium
- apple ipados, ios and ipados, iphone os +2 morePrivate Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and...4.0 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)4.3 Medium
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- graylog, graylog2 graylog2-server +1 moreGraylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value6.5 Medium
- ageerle ruoyi-aiageerle ruoyi-ai SysNoticeController.java improper authorization6.9 Medium
- ageerle ruoyi-ai, pandarobot ruoyi ai +1 moreageerle ruoyi-ai API Interface SysModelController.java improper authorization6.9 Medium
- nagios network analyzerA Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege...4.6 Medium
- microsoft azure playwrightAzure Playwright Elevation of Privilege Vulnerability8.1 High
- fpt software nightwolf penetration platformInsecure direct object references (IDOR) in NightWolf Penetration Platform8.3 High
- fpt software nightwolf penetration platformInsecure direct object references (IDOR) in NightWolf Penetration Platform8.3 High
- devolutions remote desktop managerImproper authorization in the variable component in Devolutions Remote Desktop Manager on Windows...6.8 Medium
- devolutions remote desktop managerImproper authorization in application password policy in Devolutions Remote Desktop Manager on...3.6 Low
- kyvernoKyverno ignores subjectRegExp and IssuerRegExp5.8 Medium
- qianfox foxcmsFoxCMS improper authorization5.3 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Account Profile Page userinfo.html improper authorization5.3 Medium
- vercel next.jsAuthorization Bypass in Next.js Middleware9.1 Critical
- code-projects human resource management system, human resource management +1 morecode-projects Human Resource Management System Account.go Index improper authorization5.1 Medium
- kcp-dev kcpkcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace9.6 Critical
- berriai berriai/litellmImproper Authorization in BerriAI/litellm8.1 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary7.6 High
- infiniflow infiniflow/ragflow, ragflow +1 morePartial Account Takeover due to Insecure Data Querying in infiniflow/ragflow8.1 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary7.5 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary7.1 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary6.5 Medium
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary9.8 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm docker +1 moreImproper Authorization in mintplex-labs/anything-llm4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreThe WikiManager REST API allows any user to create wikis7.9 High
- hella dr 820 firmwareAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and...7.3 High
- tastyigniterTastyIgniter Has an Incorrect Access Control Vulnerability6.5 Medium
- china mobile gt3200-4g4p, gt3200-8g8p, p22g-ciac +2 more +4 moreChina Mobile P22g-CIac Telnet Service improper authorization4.8 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorization6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization6.9 Medium
- iroad dash cam x5, dash cam x6 +1 moreIROAD Dash Cam X5/Dash Cam X6 improper authorization9.3 Critical
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt User submit improper authorization6.9 Medium
- microsoft dataverseMicrosoft Dataverse Elevation of Privilege Vulnerability7.2 High
- umbraco umbraco-cms, cms +1 moreUmbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content4.9 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality4.3 Medium
- Show moreLoading…