CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion5.3 Medium
- axeltechnology wolf1ms firmware, wolf2ms firmware +1 moreThe Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable...9.8 Critical
- wpchill modula image gallery – photo grid & video galleryImage Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move4.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm paySuccess improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelOrder improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelUserOrder improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall Order Details detail improper authorization5.3 Medium
- macrozheng mall-swarmmacrozheng mall-swarm attr updateAttr improper authorization5.3 Medium
- filebrowserFileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function7.2 High
- astrasecuritysuite astra security suite – firewall & malware scanAstra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload8.1 High
- No product listednewbee-mall-plus seckillExecution executeSeckill authorization6.3 Medium
- themeatelier idonate, idonate – blood donation, request and donor management system +1 moreIDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function8.8 High
- pig4cloud pigIn pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System...9.6 Critical
- codesolz better find and replace – ai-powered suggestionsBetter Find and Replace <= 1.7.7 - Missing Authorization4.3 Medium
- xiaozhangbang voluntary like systemA vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to...6.5 Medium
- mantisbtMantisBT unauthorized disclosure of private project column configuration5.3 Medium
- fushengqian fuintfushengqian fuint Authentication Token ClientSignController.java authorization2.3 Low
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update4.3 Medium
- barn2 plugins document library liteDocument Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- google chromeIncorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a...5.4 Medium
- dulaiduwang003 time-sea-plusdulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization5.3 Medium
- bdtask pharmacy management system, pharmacare +1 moreBdtask Pharmacy Management System User Profile edit_user authorization5.3 Medium
- code-projects client details systemcode-projects Client Details System authorization5.3 Medium
- rextheme wp vr – 360 panorama and free virtual tour builder for wordpressWP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update4.3 Medium
- themeum tutor lms proTutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments5.4 Medium
- edge22 generateblocksGenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure6.5 Medium
- saadiqbal password protected — lock entire site, pages, posts, categories, and partial contentPassword Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing3.7 Low
- originalityai originality.ai ai checkerOriginality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'4.3 Medium
- moodleMoodle: possible to bypass timer in timed assignments5.4 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user without sufficient...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- honoHono Improperly Authorizes JWT Audience Validation8.1 High
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...6.1 Medium
- kognetiks chatbot for wordpressKognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing5.3 Medium
- ninjateam filebird – wordpress media library folders & file managerFileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset4.3 Medium
- fortinet fortios, fortiproxy +1 moreAn improper authorization vulnerability [CWE-285] in Fortinet FortiOS version 7.4.0 through 7.4.1...4.2 Medium
- microsoft azure cache for redis enterprise, azure managed redis, azure cache for redis +2 moreRedis Enterprise Elevation of Privilege Vulnerability8.7 High
- better-authBetter Auth: Unauthenticated API key creation through api-key plugin9.3 Critical
github.com/casdoor/casdoorGo,govulncheck-vulndbopenSUSE +1 moreCasdoor is vulnerable to Improper Authorization7.2 High- xwiki-contrib oidcXWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right9.2 Critical
- zhuimengshaonian wisdom-educationzhuimengshaonian wisdom-education WrongBookController.java authorization5.3 Medium
- seriawei zkeacmsSeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization5.3 Medium
- Show moreLoading…