CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dot-prop project dot-propdot-prop Prototype Pollution vulnerability7.3 High
- pega platformPEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/...4.3 Medium
- pega platformPEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso...4.3 Medium
- linksys velop whw0301 firmware, velop whw0302 firmware, velop whw0303 firmware +2 moreBelkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key...9.8 Critical
- inea me-rtu firmware, mitsubishielectric smartrtu firmware +1 moreAn issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU...7.5 High
- kirona dynamic resource schedulingAn issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated...5.3 Medium
- topcon net-g5 firmwareAn issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2....8.8 High
- microsoft edge, internet explorer 10, internet explorer 11 +26 more +28 moreA security feature bypass vulnerability exists when Microsoft Browsers fail to validate the...4.3 Medium
- mediola neo servereQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows...8.2 High
- eq-3 homematic ccu2 firmware, homematic ccu3 firmware +1 moreeQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in...9.8 Critical
- schben adiveInternal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or...8.8 High
- broadlearning eclass, eclass ip +1 moreeClass platform contains a Broken Access Control vulnerability9.8 Critical
- rangerstudio directus 7 apiIn Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a...5.3 Medium
- jenkins, redhat openshift container platform +1 moreMissing Authorization in Jenkins4.3 Medium
- zyxel uag2100 firmware, uag4100 firmware, uag5100 firmware +11 more +13 moreMissing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices...9.1 Critical
- cisco rv130w wireless-n multifunction vpn router firmware, rv110w firmware, rv130w firmware +1 more +3 moreCisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability5.3 Medium
- cisco rv130w wireless-n multifunction vpn router firmware, rv110w firmware, rv130w firmware +1 more +3 moreCisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability5.3 Medium
- crestron am-100 firmware, am-101 firmware, airmedia +2 moreCrestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass...5.3 Medium
- crestron am-100 firmware, am-101 firmware, airmedia +2 moreCrestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass...5.3 Medium
- verizon fios quantum gateway (g1100), fios quantum gateway g1100 firmware +1 moreInformation disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02...7.5 High
- bmc remedy mid-tier, remedy action request system +1 moreBMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control...8.8 High
- tenable alcatel lucent i-240w-q gpon ont, nokia i-240w-q gpon ont firmware +1 moreThe Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote,...7.5 High
- eloan project eloanEloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the...9.8 Critical
- ics-cert pangea communications internet fax ata, pangea-comm fax ata +1 morePangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass...7.5 High
- dlink dir-600m firmwareD-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm...9.8 Critical
- advance peer to peer mlm script project peer to peer mlm scriptThe Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote...7.5 High
- mcafee application and change control, application change control +1 moreBypass Application Control through an ASP.NET form6.3 Medium
- abisoftgt ticketlyadd_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an...9.8 Critical
- showdocShowdoc Unauthenticated Access4.3 Medium
- van-ons wp-gdpr-complianceThe Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows...9.8 Critical
- otrs open ticket request system, debian linux +1 moreOpen Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0...6.5 Medium
- tianti project tiantitianti 2.3 allows remote authenticated users to bypass intended permission restrictions by...8.8 High
- lg supersign cmsLG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP...7.5 High
- hackerone url-parseOpen Redirect in url-parse10.0 Critical
- beaconmedaes scroll medical air systems firmwareIn TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23,...7.5 High
- asustor as6202t firmwareAn insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0...4.3 Medium
- cisco unified communications managerA vulnerability in the web framework of Cisco Unified Communications Manager could allow an...6.5 Medium
- cisco unified communications managerA vulnerability in the web framework of Cisco Unified Communications Manager could allow an...4.3 Medium
- cisco unified communications managerA vulnerability in the web framework of Cisco Unified Communications Manager could allow an...5.3 Medium
- kentico xperienceKentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global...9.8 Critical
- oxid-esales eshopOXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance),...7.5 High
- cisco content security management appliance, email security appliance firmware +1 moreA vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content...6.5 Medium
- omron ns series firmwareOMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct...9.8 Critical
- cisco unified communications managerA vulnerability in the web framework of Cisco Unified Communications Manager could allow an...5.3 Medium
- horde groupwareThe File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to...7.5 High
- iball ib-wra150n firmwareAn authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2...9.8 Critical
- nippon antenna co., ltd "dokodemo eye smart hd" scr02hd, nippon-antenna scr02hd firmware +1 more"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass...9.1 Critical
- toshiba flashair, toshiba corporation flashairtm sdhc memory card (sd-wd/wc series <w-02>), flashairtm sdhc memory card (sd-we series <w-03>) +2 moreFlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory...3.5 Low
- frogman office inc. cs-cart japanese edition, cs-cart multivendor japanese edition +1 moreCS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10...5.3 Medium
- frogman office inc. cs-cart japanese edition, cs-cart multivendor japanese edition, frogman office inc cs-cart +2 moreCS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese...5.3 Medium
- Show moreLoading…