CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ibm powerscIBM PowerSC forced browsing6.5 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreAuthentication Bypass in GoAnywhere MFT9.8 Critical
- siemens ruggedcom rm1224 lte(4g) eu, ruggedcom rm1224 lte(4g) nam, scalance m804pb +103 more +105 moreA vulnerability has been identified in SCALANCE XB205-3 (SC, PN) (All versions < V4.5), SCALANCE...4.3 Medium
- geoserver geowebcacheGeoServer GeoWebCache rest.html direct request5.3 Medium
- viessmann vitogate 300, vitogate 300 firmware +1 moreViessmann Vitogate 300 direct request4.3 Medium
- torchbox wagtailDisclosure of user names via admin bulk action views in wagtail2.7 Low
- unknown dologin securityDoLogin Security < 3.7.1 - Subscriber+ IP Address leak6.5 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- byzoro smart s85f management platformByzoro Smart S85F Management Platform php.ini direct request4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions4.3 Medium
- beijing netcon ns-asg, netentsec application security gateway +1 moreBeijing Netcon NS-ASG test_status.php direct request4.3 Medium
- jetbrains teamcityJetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a...6.5 Medium
- palantir contour, com.palantir.contour:contour-dispatch +1 moreThe contour service was not checking that users had permission to create an analysis for a given dataset2.7 Low
- control id rhidControl iD RHiD direct request6.3 Medium
- rapid7 nexposeRapid7 Nexpose Forced Browsing4.3 Medium
- black duck coverityAuthenticated Resources Accessible via Forced Browsing6.5 Medium
- statamic cms, xunruicms +1 moreXunrui CMS Install.txt direct request4.3 Medium
- mozilla firefoxWhen following a redirect to a publicly accessible web extension file, the URL may have been...6.5 Medium
- ibm cloud pak for multicloud management monitoringIBM Cloud Pak for Multicloud Management Monitoring privilege escalation7.5 High
- comfast project cf-wr623n firmwareCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1...7.5 High
- optimizingmatters autoptimize, autooptimize +1 moreAutoptimize < 3.1.0 - Sensitive Data Disclosure5.3 Medium
- zkteco zem500 firmware, zem510 firmware, zem560 firmware +7 more +9 moreCertain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive...7.5 High
- broadcom symantec identity governance and administrationAn unauthenticated user can access Identity Manager’s management console specific page URLs....5.3 Medium
- eyunjing yjcmsAn issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated...9.8 Critical
- tenda w15e firmwareThe Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure...6.5 Medium
- simple exam reviewer management system project exam reviewer management systemIn Simple Exam Reviewer Management System v1.0 the User List function has improper access control...6.5 Medium
- merchandise online store project online storeA Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get...8.8 High
- trend micro apex oneA forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to...9.1 Critical
- contec fxa2000 firmware, fxa3000 firmware, fxa3020 firmware +1 more +3 moreContec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN...8.0 High
- awesomemotive duplicator, unknown duplicator – wordpress migration plugin +1 moreDuplicator < 1.4.7 - Unauthenticated Backup Download7.5 High
- wpmanageninja ninja job board, unknown ninja job board – ultimate wordpress job board plugin +1 moreNinja Job Board < 1.3.3 - Resume Disclosure via Directory Listing7.5 High
- wavlink wifi-repeater firmwareAn access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers...5.7 Medium
- wavlink wifi-repeater firmwareAn access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers...6.3 Medium
- wavlink wifi-repeater firmwareAn access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers...5.7 Medium
- wavlink wifi-repeater firmwareAn access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers...8.0 High
- wavlink wl-wn579x3 firmwareWAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows...7.5 High
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager < 4.58 - Sensitive File Disclosure6.5 Medium
- hypr serverForced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with...7.5 High
- jupyter notebookForced Browsing in Jupyter Notebook4.3 Medium
- wavlink wn579x3 firmwareA vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows...7.5 High
- thinkcmfIncorrect Authorization in thinkcmf6.5 Medium
- money transfer management system project transfer management systemA Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1...8.8 High
- hid mercury ep4502, lp1501, lp1502 +25 more +27 moreUnauthenticated homepage note modification5.3 Medium
- hid mercury ep4502, lp1501, lp1502 +25 more +27 moreUser Account Deletion Unauthenticated7.5 High
- hid mercury ep4502, lp1501, lp1502 +25 more +27 moreUnauthenticated Firmware Upload and Arbitrary Reboot7.5 High
- tiktokThe TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may all…8.8 High
- bdtask multi store inventory management systemMulti Store Inventory Management System v1.0 was discovered to contain an information disclosure...7.5 High
- bender cc612, cc612 firmware, cc613 +3 more +5 moreBender Charge Controller: Unprotected data export8.6 High
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain...5.3 Medium
- Show moreLoading…