CWE-284 · Improper Access Control (page 29)
Page 29 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31698 | High | 7.5 | 2025-06-19 | ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl… |
CVE-2024-45208 | Critical | 9.8 | 2025-06-19 | The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566… |
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |
CVE-2025-49154 | High | 8.7 | 2025-06-17 | An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key mem… |
CVE-2025-6161 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /ed… |
CVE-2025-27689 | High | 7.8 | 2025-06-12 | Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentia… |
CVE-2025-46889 | Medium | 5.4 | 2025-06-10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low… |
CVE-2025-47962 | High | 7.8 | 2025-06-10 | Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally. |
CVE-2025-33073 | High | 8.8 | 2025-06-10 | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
CVE-2025-33056 | High | 7.5 | 2025-06-10 | Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network. |
CVE-2025-32722 | Medium | 5.5 | 2025-06-10 | Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-32714 | High | 7.8 | 2025-06-10 | Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2024-57190 | Critical | 9.8 | 2025-06-10 | Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowin… |
CVE-2025-43586 | High | 8.1 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-27207 | Medium | 6.5 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-27206 | Medium | 5.3 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-5873 | Medium | 6.3 | 2025-06-09 | A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of… |
CVE-2025-5840 | High | 7.3 | 2025-06-07 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5728 | Medium | 6.3 | 2025-06-06 | A vulnerability classified as critical was found in SourceCodester Open Source Clinic Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2025-5382 | Medium | 6.8 | 2025-06-05 | Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change adm… |
CVE-2025-3768 | Medium | 5.0 | 2025-06-05 | Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking f… |
CVE-2025-0691 | Medium | 5.0 | 2025-06-05 | Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" per… |
CVE-2025-5649 | Medium | 5.3 | 2025-06-05 | A vulnerability classified as critical has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /admin/c… |
CVE-2025-20130 | Medium | 4.9 | 2025-06-04 | A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote atta… |
CVE-2025-48999 | High | 8.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a mali… |
CVE-2024-53010 | High | 7.8 | 2025-06-03 | Memory corruption may occur while attaching VM when the HLOS retains access to VM. |
CVE-2025-5436 | Medium | 5.3 | 2025-06-02 | A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/… |
CVE-2025-5429 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of th… |
CVE-2025-5428 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the componen… |
CVE-2025-5427 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp… |
CVE-2025-5426 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-5425 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/de… |
CVE-2025-5424 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the… |
CVE-2025-5423 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/sys… |
CVE-2025-5422 | Medium | 4.3 | 2025-06-02 | A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of th… |
CVE-2025-5421 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5409 | High | 7.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mis… |
CVE-2025-5406 | Medium | 6.3 | 2025-06-01 | A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown f… |
CVE-2025-5390 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedea… |
CVE-2025-5389 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the fi… |
CVE-2025-5387 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenera… |
CVE-2025-4433 | High | 8.8 | 2025-05-30 | Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and… |
CVE-2025-4431 | Medium | 4.3 | 2025-05-30 | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c… |
CVE-2025-44619 | Critical | 9.1 | 2025-05-30 | Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentic… |
CVE-2025-27702 | Medium | 4.9 | 2025-05-28 | CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to the con… |
CVE-2024-57336 | Medium | 6.5 | 2025-05-28 | Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator… |
CVE-2025-45343 | Critical | 9.8 | 2025-05-28 | An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of the account module in the goform/setmod… |
CVE-2025-48734 | High | 8.8 | 2025-05-28 | Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers fro… |
CVE-2025-5299 | High | 7.3 | 2025-05-28 | A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-2796 | Medium | 5.3 | 2025-05-27 | On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behav… |
CVE-2025-5184 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown… |
CVE-2025-5178 | Medium | 6.3 | 2025-05-26 | A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/… |
CVE-2025-5171 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.do… |
CVE-2025-5163 | Medium | 5.3 | 2025-05-26 | A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation l… |
CVE-2025-5162 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown function… |
CVE-2025-5131 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the fi… |
CVE-2025-5130 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admi… |
CVE-2025-24917 | High | 7.8 | 2025-05-23 | In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run… |
CVE-2025-24916 | High | 7.0 | 2025-05-23 | When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure per… |
CVE-2025-3580 | Medium | 5.5 | 2025-05-23 | An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. Th… |
CVE-2025-5108 | Medium | 6.3 | 2025-05-23 | A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Pay… |
CVE-2025-5059 | Medium | 4.7 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory… |
CVE-2025-20242 | Medium | 6.5 | 2025-05-21 | A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacker to read and mod… |
CVE-2025-22157 | High | 8.8 | 2025-05-20 | This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Se… |
CVE-2025-4980 | Medium | 5.3 | 2025-05-20 | A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /curr… |
CVE-2025-4977 | Medium | 5.3 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functional… |
CVE-2025-28371 | Medium | 6.5 | 2025-05-19 | EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current pass… |
CVE-2025-4926 | Medium | 4.7 | 2025-05-19 | A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2025-4923 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown proc… |
CVE-2025-23164 | Medium | 4.4 | 2025-05-19 | A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to… |
CVE-2025-4904 | Medium | 5.3 | 2025-05-19 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of th… |
CVE-2025-4902 | Medium | 5.3 | 2025-05-19 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this issue is the function sub_48F4F… |
CVE-2025-4901 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the… |
CVE-2025-47794 | Low | 2.6 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0… |
CVE-2025-47792 | Medium | 5.0 | 2025-05-16 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user m… |
CVE-2025-2306 | Medium | 5.9 | 2025-05-16 | An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents wit… |
CVE-2025-4768 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file… |
CVE-2025-4753 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-4752 | Medium | 5.3 | 2025-05-16 | A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-4751 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.da… |
CVE-2025-4750 | Medium | 5.3 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of th… |
CVE-2025-4735 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-47161 | High | 7.8 | 2025-05-15 | Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2025-47884 | Critical | 9.1 | 2025-05-14 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment vari… |
CVE-2025-43563 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system re… |
CVE-2025-22844 | Medium | 4.3 | 2025-05-13 | Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potentially enable informati… |
CVE-2025-20100 | High | 7.5 | 2025-05-13 | Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged user to potentially e… |
CVE-2025-20076 | Medium | 5.0 | 2025-05-13 | Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potentially enable escalatio… |
CVE-2025-20052 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-45371 | Medium | 6.7 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated user to potentially e… |
CVE-2024-45333 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to potent… |
CVE-2024-43101 | Medium | 5.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an authenticated user… |
CVE-2024-39758 | Medium | 5.9 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allow an authenticated user to potentially e… |
CVE-2025-29973 | High | 7.0 | 2025-05-13 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2024-6364 | Medium | 6.4 | 2025-05-13 | A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to th… |
CVE-2025-31260 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31258 | Medium | 6.5 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31247 | High | 7.5 | 2025-05-12 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker m… |
CVE-2025-31232 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A sandboxed app may be… |
CVE-2025-31212 | Medium | 5.5 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watch… |