CWE-285: CWE-285

CVE-2025-65041 is an improper authorization vulnerability in Microsoft Partner Center that allows unauthorized attackers to elevate privileges over a ...

CVE-2023-33189 is an authorization bypass vulnerability in Pomerium identity-aware access proxy. Attackers can craft requests to bypass authorization ...

This critical vulnerability affects Cambium Networks wireless devices, allowing attackers to bypass authentication on multiple API routes. Unauthorize...

CVE-2021-37705 is an authorization bypass vulnerability in OneFuzz that allows authenticated users from any Azure AD tenant to make authorized API cal...

CVE-2021-28799 is an improper authorization vulnerability in QNAP's HBS 3 backup software that allows remote attackers to bypass authentication and lo...

CVE-2025-49746 is an improper authorization vulnerability in Azure Machine Learning that allows authenticated attackers to escalate privileges over th...

This critical Azure vulnerability allows authenticated attackers to escalate privileges within cloud environments, potentially gaining administrative ...

This vulnerability allows unauthorized Command Centre Operators to modify command line macros in Gallagher Command Centre Server, potentially executin...

An authentication bypass vulnerability in FUXA web-based SCADA/HMI software allows unauthenticated remote attackers to gain administrative access via ...

This vulnerability in PlaciPy version 1.0.0 allows attackers to execute code evaluation outside of intended assessment windows due to missing lifecycl...

This vulnerability allows a Power User in Terminalfour to bypass authorization checks and escalate privileges for other accounts. By intercepting and ...

This CVE describes an authorization bypass vulnerability in Apple operating systems that allows malicious apps to access sensitive user data without p...

The Icons Factory WordPress plugin contains an arbitrary file deletion vulnerability that allows unauthenticated attackers to delete any file on the s...

The Frontend Dashboard WordPress plugin versions 1.0 to 2.2.6 contain a privilege escalation vulnerability that allows unauthenticated attackers to re...

The Job Listings WordPress plugin versions 0.1 to 0.1.1 contain a privilege escalation vulnerability that allows unauthenticated attackers to register...

CVE-2025-30392 is an improper authorization vulnerability in Azure Bot Framework SDK that allows unauthorized attackers to elevate privileges over a n...

This vulnerability allows any user to exploit the WikiManager REST API in XWiki Platform to create a new wiki and gain administrator privileges. This ...

OpenFGA versions before 1.8.5 contain an authorization bypass vulnerability that allows unauthorized access when specific Check and ListObject API cal...

OpenFGA versions 1.3.8 to 1.8.2 contain an authorization bypass vulnerability when using conditions with contextual tuples and caching enabled. Attack...

CVE-2024-36108 is an authorization bypass vulnerability in casgate identity management system that allows unauthenticated attackers to access sensitiv...

This vulnerability allows unauthenticated attackers to execute arbitrary commands on TOTOLINK EX1800T routers by exploiting the apcliEncrypType parame...

Danswer AI Assistant versions before 3.63 have an authorization flaw allowing unauthorized access to Slack bot tokens. Attackers with network access c...

CVE-2022-3748 is an authentication bypass vulnerability in ForgeRock Access Management that allows attackers to gain unauthorized access without valid...

CVE-2022-3229 is an authentication bypass vulnerability in Unified Remote's web management interface that allows unauthenticated attackers to disable ...

CVE-2022-24083 is a critical authentication bypass vulnerability in Pega Platform that allows attackers to circumvent local password checks, potential...

CVE-2021-42338 is an authentication bypass vulnerability in 4MOSAn GCB Doctor's login page that allows unauthenticated attackers to inject malicious c...

CVE-2021-3044 is an improper authorization vulnerability in Palo Alto Networks Cortex XSOAR that allows remote unauthenticated attackers with network ...

This vulnerability allows Deno modules imported dynamically via import() or new Worker to bypass network and file system permission checks when static...

This vulnerability allows editors with limited permissions in Grav CMS to modify form processing logic by manipulating YAML frontmatter in POST reques...

This vulnerability in kcp allows attackers to create or delete objects in any arbitrary target workspace via the APIExport VirtualWorkspace, bypassing...

This vulnerability in Lenovo Smart Camera models X3, X5, and C2E allows unauthorized users to access device information, modify firmware, and change d...

This critical vulnerability in Azure Entra ID (formerly Azure Active Directory) allows attackers to elevate privileges within cloud environments. Atta...

This critical vulnerability in LibreChat allows authenticated users to execute arbitrary shell commands as root within the container via a single API ...

An Insecure Direct Object Reference (IDOR) vulnerability in Rallly allows any authenticated user to finalize polls they don't own by manipulating the ...

This is an elevation of privilege vulnerability in Azure Portal that allows authenticated users to gain unauthorized administrative access. It affects...

This CVE describes an authorization bypass vulnerability in Next.js middleware. Attackers can bypass authorization checks by sending requests with the...

This CVE describes an Improper Authorization vulnerability in Drupal Open Social that allows attackers to collect data from common resource locations ...

DedeCMS V5.7.114 contains an improper authorization vulnerability in mail_file_manage.php that allows attackers to delete any file on the server. This...

CVE-2023-2227 is an improper authorization vulnerability in Modoboa email management software that allows authenticated users to access administrative...

CVE-2022-38375 is an improper authorization vulnerability in Fortinet FortiNAC that allows unauthenticated attackers to perform administrative operati...

This vulnerability in Arista EOS allows local users with 'nopassword' configuration to gain unrestricted access to network devices due to incorrect AA...

CVE-2021-28506 is an authentication bypass vulnerability in Arista EOS gNOI APIs that allows unauthorized factory resets of network devices. This affe...

CVE-2021-41974 is an authentication bypass vulnerability in Tad Book3 that allows remote attackers to view and modify arbitrary book content without p...

This vulnerability in Misskey allows third-party applications to access endpoints or Websocket APIs without proper user permission due to incorrect 'k...