CWE-285: Improper Authorization, page 27
Filter
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
What the weakness is: CWE-285 at MITRE
Ask an AI about CWE-285
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-285: Improper Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/285.html and https://cve.bz/cve/cwe/285?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 4.9CVE-2023-32482EPSS 0.5%
Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privileged access can push policies to unauthorized tenant group.
- 6.5CVE-2023-3574EPSS 0.5%
Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
- 7.1CVE-2023-25517EPSS 0.2%
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not authorized, which may lead to information disclosure and data tampering.
- 6.5CVE-2023-36611EPSS 0.5%
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and pro…
- 9.8CVE-2023-34460EPSS 0.6%
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard sc…
- 5.5CVE-2023-0837EPSS 0.2%
An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. T…
- 6.5CVE-2023-33142EPSS 1.0%
Microsoft SharePoint Server Elevation of Privilege Vulnerability
- 7.6CVE-2023-32022EPSS 0.8%
Windows Server Service Security Feature Bypass Vulnerability
- 4.3CVE-2023-1910EPSS 0.5%
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote_templates function in versions up to, and including, 1.8.3. This makes it possi…
- 8.1CVE-2023-29152EPSS 0.4%
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- 3.3CVE-2023-24476EPSS 0.1%
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.
- 5.4CVE-2021-4344EPSS 0.5%
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling the use of user IDs that is accessible by the visitor. This makes it possible f…
- 4.3CVE-2020-36729EPSS 0.7%
The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via the wp_ajax_twoj_slideshow_setup AJAX action in versions up to, and including, …
- 7.5CVE-2020-36696EPSS 1.1%
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for un…
- 4.3CVE-2019-25149EPSS 0.6%
The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, includi…
- 6.5CVE-2023-30948EPSS 0.5%
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment …
- 7.5CVE-2022-40536EPSS 0.4%
Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
- 7.5CVE-2022-40521EPSS 0.4%
Transient DOS due to improper authorization in Modem
- 4.3CVE-2023-0584EPSS 0.5%
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above,…
- 4.3CVE-2023-0583EPSS 0.5%
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions…
- 6.5CVE-2023-34091EPSS 0.5%
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `val…
- 4.3CVE-2023-32717EPSS 0.4%
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they k…
- 4.3CVE-2023-32709EPSS 0.4%
In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the …
- 8.8CVE-2023-32707ExploitEPSS 79%
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges…
- 4.3CVE-2023-34219EPSS 0.4%
In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API
- 9.8CVE-2023-33189EPSS 0.9%
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
- 4.3CVE-2023-33183EPSS 0.4%
Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.…
- 8.1CVE-2023-2950EPSS 0.6%
Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- 7.5CVE-2023-2496EPSS 0.8%
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. …
- 3.7CVE-2023-28623EPSS 0.5%
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only…
- 5.5CVE-2023-2782EPSS 0.2%
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
- 7.5CVE-2022-45450EPSS 0.4%
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 3…
- 4.3CVE-2023-20184EPSS 0.5%
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted conta…
- 4.3CVE-2023-20183EPSS 0.5%
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted conta…
- 8.8CVE-2023-20182EPSS 0.6%
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted conta…
- 4.3CVE-2023-22348EPSS 0.6%
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.
- 6.5CVE-2023-28325EPSS 0.4%
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target roo…
- 5.5CVE-2022-45128EPSS 0.2%
Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local access.
- 5.5CVE-2022-43465EPSS 0.2%
Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable denial of service via local access.
- 5.5CVE-2022-41610EPSS 0.2%
Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access.
- 5.3CVE-2023-28318EPSS 0.3%
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, h…
- 5.3CVE-2023-28317EPSS 0.2%
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
- 6.6CVE-2023-29338EPSS 0.9%
Visual Studio Code Spoofing Vulnerability
- 8.1CVE-2023-2534EPSS 0.5%
Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with re…
- 8.6CVE-2023-21505EPSS 0.3%
Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in sandbox.
- 9.8CVE-2023-30467EPSS 1.1%
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attack…
- 9.8CVE-2023-2345EPSS 0.5%
A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to…
- 9.1CVE-2023-2227ExploitEPSS 44%
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
- 7.1CVE-2023-28973EPSS 0.1%
An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute administrative commands that could impact the integrity of the system or system…
- 9.8CVE-2022-3748EPSS 0.9%
Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.