689
Observed Examples
Reference Description
CVE-2022-24730 Go-based continuous deployment product does not check that a user has
certain privileges to update or create an app, allowing adversaries to read
sensitive repository information
https://www.cve.org/CVERecord?id=CVE-2022-24730
CVE-2009-3168 Web application does not restrict access to admin scripts, allowing
authenticated users to reset administrative passwords.
https://www.cve.org/CVERecord?id=CVE-2009-3168
CVE-2009-2960 Web application does not restrict access to admin scripts, allowing
authenticated users to modify passwords of other users.
https://www.cve.org/CVERecord?id=CVE-2009-2960
CVE-2009-3597 Web application stores database file under the web root with insufficient
access control (CWE-219), allowing direct request.
https://www.cve.org/CVERecord?id=CVE-2009-3597
CVE-2009-2282 Terminal server does not check authorization for guest access.
https://www.cve.org/CVERecord?id=CVE-2009-2282
CVE-2009-3230 Database server does not use appropriate privileges for certain sensitive
operations.
https://www.cve.org/CVERecord?id=CVE-2009-3230
CVE-2009-2213 Gateway uses default "Allow" configuration for its authorization settings.
https://www.cve.org/CVERecord?id=CVE-2009-2213
CVE-2009-0034 Chain: product does not properly interpret a configuration option for a system
group, allowing users to gain privileges.
https://www.cve.org/CVERecord?id=CVE-2009-0034
CVE-2008-6123 Chain: SNMP product does not properly parse a configuration option for which
hosts are allowed to connect, allowing unauthorized IP addresses to connect.
https://www.cve.org/CVERecord?id=CVE-2008-6123
CVE-2008-5027 System monitoring software allows users to bypass authorization by creating
custom forms.
https://www.cve.org/CVERecord?id=CVE-2008-5027
CVE-2008-7109 Chain: reliance on client-side security (CWE-602) allows attackers to bypass
authorization using a custom client.
https://www.cve.org/CVERecord?id=CVE-2008-7109
CVE-2008-3424 Chain: product does not properly handle wildcards in an authorization policy
list, allowing unintended access.
https://www.cve.org/CVERecord?id=CVE-2008-3424
CVE-2009-3781 Content management system does not check access permissions for private
files, allowing others to view those files.
https://www.cve.org/CVERecord?id=CVE-2009-3781
CVE-2008-4577 ACL-based protection mechanism treats negative access rights as if they are
positive, allowing bypass of intended restrictions.
https://www.cve.org/CVERecord?id=CVE-2008-4577
CVE-2008-6548 Product does not check the ACL of a page accessed using an "include"
directive, allowing attackers to read unauthorized files.
https://www.cve.org/CVERecord?id=CVE-2008-6548
CVE-2007-2925 Default ACL list for a DNS server does not set certain ACLs, allowing
unauthorized DNS queries.
https://www.cve.org/CVERecord?id=CVE-2007-2925
CVE-2006-6679 Product relies on the X-Forwarded-For HTTP header for authorization, allowing
unintended access by spoofing the header.
https://www.cve.org/CVERecord?id=CVE-2006-6679
CVE-2005-3623 OS kernel does not check for a certain privilege before setting ACLs for files.
https://www.cve.org/CVERecord?id=CVE-2005-3623
CWE Version 4.14
CWE-285: Improper Authorization
CWE-285: Improper Authorization