Weakness (CWE)
CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
-
Architecture and Design
Consider using MVC based frameworks such as Struts.
Source: MITRE CWE-425
29 results · Clear filters · Feed
-
High 8.8
Apache OFBiz: Authenticated Code Execution Vulnerability
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute a…
-
High 7.5
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fix…
-
High 7.5
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.
-
High 8.8
Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer…
-
High 7.4
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra…
-
High 7.2
Authenticated unintended access to critical program parameters
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
-
High 8.5
Argo Workflows Is Missing Authorization in Sync ConfigMap Provider
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization chec…
-
High 8.7
LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to m…
-
High 8.1
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read tra…
-
High 7.7
OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data
OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs…
-
High 7.1
NATS allows MQTT clients to bypass ACL checks
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass …
-
High 8.6
Credentials exposure in tinycontrol devices
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has been fixed in firmware …
-
High 7.1
Unauthorized Access to files in WODESYS WD-R608U router
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in question. The vendor was notified early about this vulnerability, but didn't respond with the details o…
-
High 8.6
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
-
High 8.6
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
-
High 8.6
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
-
High 8.6
The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure …
-
High 8.6
Vonets WiFi Bridges Forced Browsing
An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct reques…
-
High 7.6
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not …
-
High 7.6
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not …
-
High 7.5
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnera…
-
High 7.5CVE-2022-42953 Public exploit
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct …
-
High 8.8
A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin d…
-
High 8.8
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which …
-
High 7.5
Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recov…
-
High 7.5
User Account Deletion Unauthenticated
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware…
-
High 7.5
Unauthenticated Firmware Upload and Arbitrary Reboot
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502…
-
High 8.6
Bender Charge Controller: Unprotected data export
In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
-
High 7.3
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.