CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- fuyang lipengjun platformfuyang_lipengjun platform AdPositionController queryAll improper authorization5.3 Medium
- eladminelunez eladmin SysLogController 1 queryErrorLogDetail improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar turma improper authorization5.3 Medium
- eladminelunez eladmin Email Address updateEmail updateUserEmail improper authorization2.3 Low
- elunez eladminelunez eladmin LocalStorageController deleteFile improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll AdController improper authorization5.3 Medium
- macrozheng mallmacrozheng mall paySuccess authorization5.3 Medium
- macrozheng mallmacrozheng mall cancelUserOrder cancelOrder authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar Matricula API matricula improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar processamentoApi improper authorization5.3 Medium
- nofusscomputing centurion erpCenturion ERP users can view hashed authentication tokens that belong to other users1.9 Low
- aurelienlws lwscacheLWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function4.3 Medium
- portabilis i-educarPortabilis i-Educar consulta improper authorization5.3 Medium
- rockoaXinhu RockOA index.php publicsaveAjax improper authorization5.3 Medium
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability9.1 Critical
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update4.3 Medium
- liuyuyang01 thrivex-blogLiuYuYang01 ThriveX-Blog web updateJsonValueByName improper authorization5.3 Medium
- artkrylov icons factoryIcons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function9.8 Critical
- apache supersetApache Superset: Incorrect datasource authorization on REST API5.3 Medium
- jishenghua jsherpjshERP Endpoint deleteBatch improper authorization5.3 Medium
- jishenghua jsherpjshERP Endpoint addUser improper authorization5.3 Medium
- litmuschaos litmusLitmusChaos Litmus LocalStorage authorization4.8 Medium
- litmuschaos litmusLitmusChaos Litmus list_projects improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar API Endpoint pessoa improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar API Endpoint Diario authorization5.3 Medium
- tduckcloud tduck-platformTDuckCloud tduck-platform manage preHandle improper authorization5.3 Medium
- macrozheng mallmacrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization6.9 Medium
- salesagility suitecrmSuiteCRM: Improper Authorization for attachment downloads3.7 Low
- microsoft azure portalAzure Portal Elevation of Privilege Vulnerability9.1 Critical
- atjiu pybbsatjiu pybbs Email Verification improper authorization6.9 Medium
- danny-avila librechatLibreChat exposes arbitrary chats through Meilisearch engine7.5 High
- anysphere cursorCursor Agent is vulnerable prompt injection via Editor Special Files7.5 High
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 moreHT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure4.3 Medium
- finos gitproxy, git-proxy +1 moreGitProxy is vulnerable to a new branch approval exploit8.2 High
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT Platform Exposes Graph Execution Results via Authorization Gap7.7 High
- vaelsys, vaelsys vaelsysv4 +1 moreVaelsys VaelsysV4 User Creation vgrid_server.php improper authorization6.9 Medium
- psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 moreHAX CMS Backend Lacks Comprehensive Authorization Checks8.3 High
- jishenghua jsherpjshERP Account delete improper authorization5.3 Medium
- jerryshensjf jpacookieshop, jpacookieshop 蛋糕商城jpa版 +1 morejerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization5.3 Medium
- microsoft azure machine learningAzure Machine Learning Elevation of Privilege Vulnerability9.9 Critical
- citeum openctiOpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users5.4 Medium
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web...6.1 Medium
- directusDirectus missing permission checks for manual trigger Flows6.5 Medium
- avid nexis e-series, nexis f-series, nexis pro+ +1 more +3 moreAuthenticated Arbitrary File Read affecting Avid NEXIS8.7 High
- palantir com.palantir.secupload:secure-uploadAccess control issues impacting secure-upload service5.4 Medium
- canonical jujuArbitrary executable upload via authenticated endpoint8.8 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- canonical jujuSensitive log retrieval in Juju6.5 Medium
- giscusgiscus allows unauthorized discussion creation5.3 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage7.7 High
- Show moreLoading…