CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.5.3 Medium
- siemens sicam a8000 cp-8031, sicam a8000 cp-8050, sicam a8000 cp-8031 firmware +1 more +3 moreA vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP...7.5 High
- reprisesoftware reprise license managerReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET...5.3 Medium
- tem flex-1080, flex-1085, flex-1080 firmware +1 more +3 moreTEM FLEX-1080/FLEX-1085 Log information disclosure5.3 Medium
- eyoucmsEyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.9.8 Critical
- smartertools smartertrackInformation disclosure via direct object access on SmarterTrack v100.0.8019.140106.5 Medium
- google android, samsung cloud, samsung mobile clould +1 more +3 moreImproper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022...4.2 Medium
- dlink dir-850l firmwareDLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an...7.5 High
- ametysThe auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to...5.3 Medium
- twisted treq, debian linux +1 moreUnsafe handling of user-specified cookies in treq6.5 Medium
- meta platforms, inc ray-ban® stories smart glasses, ray-ban stories rw4002 601\/71 50-22 firmware, stories rw4003 65582v 48-23 firmware +2 more +4 moreA logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture...5.3 Medium
- fastlinemedia beaver builderIn Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection...5.3 Medium
- rich-web tab, unknown tab – accordion, faq +1 moreTab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls7.5 High
- mra13 simple download monitorSimple Download Monitor < 3.9.6 - Unauthenticated Log Access7.5 High
- engineers online portal project online portalAn incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP...7.5 High
- phone shop sales management system project shop sales management systemPhone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to...9.8 Critical
- mitsubishielectric smartrtu firmwareMitsubishi Electric SmartRTU devices allow remote attackers to obtain sensitive information ...7.5 High
- trend micro serverprotect for emc celerra, serverprotect for microsoft windows / novell netware, serverprotect for network appliance filers +2 more +4 moreA vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8,...9.8 Critical
- gurock testrailImproper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive...7.5 High
- atlassian confluence server, confluence data center +1 moreAffected versions of Atlassian Confluence Server allow remote attackers to view restricted...5.3 Medium
- tecnick tcexamWhen installed following the default/recommended settings, TCExam <= 14.8.1 allowed...7.5 High
- hongdian h8922 firmwareHongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the...5.5 Medium
- purethemes findeo, realteo +1 moreRealteo < 1.2.4 - Arbitrary Property Deletion via IDOR6.5 Medium
- unknown controlled admin accessControlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation9.8 Critical
- glpi-project dashboardThe Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access...4.3 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access...4.3 Medium
- helmholz myrex24, myrex24.virtual, mbconnectline mbconnect24 +1 more +3 moreForeced Browsing vulnerability in products of MB connect line and Helmholz5.3 Medium
- netsia seba\+Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies...7.5 High
- vikisolutions veraAn issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could...8.1 High
- tenda f3 firmwareTenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information ...9.6 Critical
- webform report project reportThe Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by...7.5 High
- dlink dap-1650 firmwareAn issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix....9.8 Critical
- nchsoftware express accountsIn NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted...6.5 Medium
- schneider-electric 140cpu65150 firmware, 140noc77101 firmware, 140noc78000 firmware +17 more +19 moreA CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon...5.3 Medium
- asus rt-ac88u firmwareAn information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A...7.5 High
- openclinic project openclinicOpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows...7.5 High
- mind imind serverInterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self...7.5 High
- logaritmo aware callmanagerinfo.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive...7.5 High
- debian linux, lemonldap-ng lemonldap\ +1 moreLack of URL normalization may lead to authorization bypass when URL access rules are used9.8 Critical
- projectworlds travel management systemInsecure File Permissions and Arbitrary File Upload in the upload pic function in...9.8 Critical
- pandorafms pandora fmsArtica Pandora FMS 7.44 has inadequate access controls on a web folder.7.5 High
- mongodb ops managerPotential exposure of log information in Ops Manager5.8 Medium
- nchsoftware express invoiceIn NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to...8.8 High
- sumavision enhanced multimedia router (emr), enhanced multimedia router firmware +1 moregoform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of...9.8 Critical
- meinbwa direx-pro firmwareBWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to...7.5 High
- monstraMonstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts...6.5 Medium
- centreonAn issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive...7.5 High
- centreonAn issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides...7.5 High
- centreonAn issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides...7.5 High
- centreonAn issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides...7.5 High
- Show moreLoading…