cve.bz

CWE-285: Improper Authorization, page 21

Filter

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

Ask an AI about CWE-285

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-285: Improper Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/285.html and https://cve.bz/cve/cwe/285?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.0CVE-2023-42973EPSS 0.2%

    Private Browsing tabs may be accessed without authentication. This issue is fixed in iOS 17 and iPadOS 17. The issue was addressed with improved UI.

  2. 8.8CVE-2025-29794EPSS 4.9%

    Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  3. 5.3CVE-2025-30373EPSS 0.3%

    Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in ca…

  4. 6.9CVE-2025-3202EPSS 0.5%

    A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The ma…

  5. 6.9CVE-2025-3199EPSS 0.6%

    A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelCont…

  6. 4.6CVE-2025-28131EPSS 0.4%

    A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw…

  7. 9.8CVE-2025-26683EPSS 0.7%

    Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.

  8. 8.3CVE-2025-3014EPSS 0.3%

    Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

  9. 8.3CVE-2025-3013EPSS 0.3%

    Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

  10. 6.8CVE-2025-2600EPSS 0.4%

    Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". …

  11. 3.6CVE-2025-2528EPSS 0.2%

    Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affec…

  12. 8.0CVE-2025-29778EPSS 0.3%

    Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to d…

  13. 5.3CVE-2025-2653EPSS 0.3%

    A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been discl…

  14. 5.3CVE-2025-2639EPSS 0.4%

    A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of the component Article Handler. The manipulation leads to improper authorization…

  15. 5.3CVE-2025-2638EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 …

  16. 5.3CVE-2025-2637EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of t…

  17. 9.1CVE-2025-29927ExploitEPSS 99.2%

    Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the…

  18. 5.1CVE-2025-2589EPSS 0.5%

    A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to impr…

  19. 9.6CVE-2025-29922EPSS 0.4%

    kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any …

  20. 7.9CVE-2025-29926EPSS 0.6%

    XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. …

  21. 7.3CVE-2025-30117EPSS 0.4%

    An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attac…

  22. 6.5CVE-2024-44314EPSS 0.3%

    TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which f…

  23. 4.8CVE-2025-2397EPSS 0.2%

    A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as problematic. This vulnerability affects unknown code of the component Telnet Service. …

  24. 6.9CVE-2025-2360EPSS 4.2%

    A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPA…

  25. 6.9CVE-2025-2359EPSS 15%

    A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the component DDNS Service. The manipulation of the argument SOAPAction leads to im…

  26. 9.3CVE-2025-2345EPSS 0.8%

    A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipulation leads to improper authorization. It is possible to initiate the attack re…

  27. 6.9CVE-2025-2320EPSS 0.7%

    A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit of the file /api/blade-user/submit of the component User Handler. The manipulat…

  28. 7.2CVE-2025-24053EPSS 0.8%

    Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.

  29. 6.4CVE-2025-27602EPSS 0.3%

    Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice user…

  30. 4.3CVE-2025-27601EPSS 0.3%

    Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to…

  31. 6.3CVE-2025-2114EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This issue affects some unknown processing of the file /WebPages/Adm/OperatorStop.asp of the…

  32. 4.3CVE-2024-13552EPSS 0.3%

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled …

  33. 9.3CVE-2025-27509EPSS 0.7%

    fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account …

  34. 4.3CVE-2024-13724EPSS 0.2%

    The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it…

  35. 5.5CVE-2024-43051EPSS 0.1%

    Information disclosure while deriving keys for a session for any Widevine use case.

  36. 5.3CVE-2025-1847EPSS 0.5%

    A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been di…

  37. 6.9CVE-2025-1815EPSS 0.5%

    A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument user_cookie leads to improper authorization. It i…

  38. 5.3CVE-2025-1806EPSS 0.3%

    A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to i…

  39. 5.3CVE-2025-27399EPSS 0.4%

    Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are n…

  40. 7.7CVE-2024-47053EPSS 0.7%

    This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in …

  41. 6.9CVE-2025-23024EPSS 0.3%

    GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `in…

  42. 5.3CVE-2025-1607EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salary_slip.php. The manipulation of the argument id …

  43. 5.3CVE-2025-1361ExploitEPSS 1.3%

    The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unaut…

  44. 5.8CVE-2025-25196EPSS 0.4%

    OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart < openfga-0.2.22, docker < v.1.8.4) are vulnerable to authorization bypass when c…

  45. 6.9CVE-2025-1007EPSS 0.5%

    In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, su…

  46. 5.4CVE-2024-13692EPSS 0.3%

    The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 vi…

  47. 6.9CVE-2025-1226EPSS 0.8%

    A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated re…

  48. 5.3CVE-2024-13821EPSS 0.4%

    The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a book…

  49. 8.1CVE-2025-24418EPSS 1.0%

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vuln…

  50. 8.0CVE-2025-21400EPSS 34%

    Microsoft SharePoint Server Remote Code Execution Vulnerability