CWE-284 · Improper Access Control (page 30)
Page 30 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31195 | Medium | 6.3 | 2025-05-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox. |
CVE-2025-30436 | Critical | 9.1 | 2025-05-12 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker may be able to use Sir… |
CVE-2025-4538 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of th… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-28201 | Medium | 6.8 | 2025-05-09 | An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access. |
CVE-2025-4468 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-33072 | High | 8.1 | 2025-05-08 | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
CVE-2025-20223 | Medium | 4.7 | 2025-05-07 | A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that… |
CVE-2025-20190 | Medium | 6.5 | 2025-05-07 | A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbi… |
CVE-2025-20137 | Medium | 4.7 | 2025-05-07 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Swi… |
CVE-2025-29448 | High | 7.5 | 2025-05-07 | Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of ser… |
CVE-2025-46816 | Critical | 9.4 | 2025-05-06 | goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone t… |
CVE-2025-21470 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter. |
CVE-2025-21469 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call. |
CVE-2024-49842 | High | 7.8 | 2025-05-06 | Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions. |
CVE-2025-4333 | Medium | 6.3 | 2025-05-06 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFil… |
CVE-2025-46589 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-46588 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-4310 | Medium | 4.7 | 2025-05-06 | A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic… |
CVE-2025-4305 | Medium | 6.3 | 2025-05-06 | A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/co… |
CVE-2025-4291 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted… |
CVE-2025-45618 | Medium | 6.5 | 2025-05-05 | Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive infor… |
CVE-2025-45617 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45616 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45615 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request. |
CVE-2025-45614 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45613 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45612 | Critical | 9.8 | 2025-05-05 | Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. |
CVE-2025-45611 | Critical | 9.8 | 2025-05-05 | Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request. |
CVE-2025-45610 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloa… |
CVE-2025-45609 | High | 7.5 | 2025-05-05 | Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-45608 | High | 7.5 | 2025-05-05 | Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. |
CVE-2025-4051 | Medium | 6.3 | 2025-05-05 | Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-45237 | High | 7.5 | 2025-05-05 | Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information… |
CVE-2025-4281 | Medium | 4.3 | 2025-05-05 | A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an u… |
CVE-2025-4316 | Medium | 4.3 | 2025-05-05 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy v… |
CVE-2025-4271 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4270 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cg… |
CVE-2025-4269 | Medium | 6.5 | 2025-05-05 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2025-4258 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master… |
CVE-2024-48905 | Critical | 9.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. |
CVE-2025-46635 | High | 7.1 | 2025-05-01 | An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the ro… |
CVE-2025-46629 | Medium | 6.5 | 2025-05-01 | Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized confi… |
CVE-2025-46628 | High | 7.3 | 2025-05-01 | Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shel… |
CVE-2025-46566 | Critical | 9.8 | 2025-05-01 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2024-30146 | Medium | 4.1 | 2025-04-30 | Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2025-46331 | Critical | 9.8 | 2025-04-30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Hel… |
CVE-2025-24887 | Medium | 6.3 | 2025-04-30 | OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2025-32376 | Medium | 4.3 | 2025-04-30 | Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can… |
CVE-2025-27134 | High | 8.8 | 2025-04-30 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a p… |
CVE-2025-4119 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Produc… |
CVE-2025-4118 | Medium | 5.3 | 2025-04-30 | A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product His… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-25962 | Critical | 9.8 | 2025-04-29 | An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function |
CVE-2025-4067 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpack… |
CVE-2025-4066 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-4065 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-4036 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/g… |
CVE-2025-32470 | High | 7.5 | 2025-04-28 | A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device. |
CVE-2025-4006 | Medium | 4.7 | 2025-04-28 | A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the c… |
CVE-2025-3978 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/vie… |
CVE-2025-3975 | Medium | 5.3 | 2025-04-27 | A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2025-3969 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-3966 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/hom… |
CVE-2025-43862 | High | 7.6 | 2025-04-25 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web… |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2025-43947 | High | 7.3 | 2025-04-22 | Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modi… |
CVE-2025-3518 | Medium | 4.3 | 2025-04-22 | It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can… |
CVE-2025-28104 | Critical | 9.1 | 2025-04-21 | Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. |
CVE-2025-28367 | Medium | 6.5 | 2025-04-21 | mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerabili… |
CVE-2025-3830 | Medium | 6.3 | 2025-04-20 | A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the… |
CVE-2025-3807 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/co… |
CVE-2025-3798 | Medium | 4.7 | 2025-04-19 | A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php… |
CVE-2025-28233 | Critical | 9.1 | 2025-04-18 | Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Cont… |
CVE-2025-28231 | Critical | 9.1 | 2025-04-18 | Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges. |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2025-32795 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly gran… |
CVE-2025-28232 | Critical | 9.1 | 2025-04-18 | Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication. |
CVE-2025-28229 | Critical | 9.8 | 2025-04-18 | Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges. |
CVE-2025-3790 | Medium | 5.3 | 2025-04-18 | A vulnerability classified as critical has been found in baseweb JSite 1.0. This affects an unknown part of the file /druid/index.html of the component Apache… |
CVE-2025-32790 | Medium | 6.3 | 2025-04-18 | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improper… |
CVE-2025-3783 | Medium | 6.3 | 2025-04-18 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unkno… |
CVE-2025-3765 | Medium | 6.3 | 2025-04-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3764 | Medium | 6.3 | 2025-04-17 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3113 | | 2025-04-17 | A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicatio… | |
CVE-2025-1568 | High | 8.8 | 2025-04-16 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to in… |
CVE-2024-53304 | Medium | 6.5 | 2025-04-16 | An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing a… |
CVE-2025-3675 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of t… |
CVE-2025-3674 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilt… |
CVE-2025-3668 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of… |
CVE-2025-3667 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-b… |
CVE-2025-3666 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this issue is the function setDdnsCfg of the file /c… |
CVE-2025-3665 | Medium | 5.3 | 2025-04-16 | A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosC… |
CVE-2025-3664 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWiFiEasyGuestCfg of the file… |
CVE-2025-3663 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setW… |
CVE-2025-30100 | Medium | 6.7 | 2025-04-16 | Dell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control Vulnerability. A low privileged attacker with local access cou… |