CWE-284 · Improper Access Control (page 31)
Page 31 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30740 | Medium | 6.5 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30736 | High | 7.4 | 2025-04-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Difficult to… |
CVE-2025-30735 | High | 8.1 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration). The supporte… |
CVE-2025-30732 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30731 | Low | 3.6 | 2025-04-15 | Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected… |
CVE-2025-30729 | Medium | 5.5 | 2025-04-15 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-30728 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily… |
CVE-2025-30726 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30714 | Medium | 4.8 | 2025-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0-9.2.0. Difficult t… |
CVE-2025-30713 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The supported version that i… |
CVE-2025-30711 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Supported versions that are affec… |
CVE-2025-30710 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions that are affected are 8.0.0-8.0.41, 8.4… |
CVE-2025-30709 | Medium | 6.1 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30707 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.14. E… |
CVE-2025-30700 | Low | 3.5 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). The supported version that is affected is 11. Eas… |
CVE-2025-30699 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-… |
CVE-2025-30698 | Medium | 5.6 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |
CVE-2025-30697 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2025-30696 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0… |
CVE-2025-30695 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30694 | Medium | 5.4 | 2025-04-15 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily… |
CVE-2025-30693 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30692 | Medium | 6.5 | 2025-04-15 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.7-12.2… |
CVE-2025-30691 | Medium | 4.8 | 2025-04-15 | Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and… |
CVE-2025-30690 | High | 7.2 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Difficult to exploit vul… |
CVE-2025-30689 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21588 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.4.0-8.4.4 and 9.0.0-9.2.0. Eas… |
CVE-2025-21587 | High | 7.4 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2025-21586 | Medium | 5.4 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-21573 | Medium | 6.0 | 2025-04-15 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supporte… |
CVE-2025-29705 | Medium | 4.3 | 2025-04-15 | code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects. |
CVE-2025-29984 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could pote… |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-3593 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of th… |
CVE-2025-3585 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser… |
CVE-2025-3566 | High | 7.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discu… |
CVE-2025-3565 | Medium | 4.7 | 2025-04-14 | A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uplo… |
CVE-2025-3558 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHead… |
CVE-2025-32726 | Medium | 6.8 | 2025-04-12 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2023-42969 | Low | 3.3 | 2025-04-11 | An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, mac… |
CVE-2025-23389 | High | 8.4 | 2025-04-11 | A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This is… |
CVE-2025-27191 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-27190 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-30288 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypas… |
CVE-2025-30281 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution… |
CVE-2025-29810 | High | 7.5 | 2025-04-08 | Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29804 | High | 7.3 | 2025-04-08 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-27744 | High | 7.8 | 2025-04-08 | Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2025-27738 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network. |
CVE-2025-26678 | High | 8.4 | 2025-04-08 | Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-21197 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permissi… |
CVE-2025-3410 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-pla… |
CVE-2025-3398 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/sr… |
CVE-2025-28413 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component |
CVE-2025-28412 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController |
CVE-2025-28411 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave |
CVE-2025-28410 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting us… |
CVE-2025-28409 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether… |
CVE-2025-28408 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not prope… |
CVE-2025-28407 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether… |
CVE-2025-28406 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter |
CVE-2025-28405 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method |
CVE-2025-28403 | High | 7.2 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has ad… |
CVE-2025-28402 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter |
CVE-2025-21425 | High | 7.3 | 2025-04-07 | Memory corruption may occur due top improper access control in HAB process. |
CVE-2025-3325 | Medium | 4.3 | 2025-04-06 | A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the com… |
CVE-2025-3324 | Medium | 6.3 | 2025-04-06 | A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality o… |
CVE-2025-3305 | Medium | 4.3 | 2025-04-05 | A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addIntercept… |
CVE-2025-3298 | Medium | 4.3 | 2025-04-05 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2025-3256 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/upd… |
CVE-2025-3255 | Medium | 4.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-3244 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-3237 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/wrlwpsse… |
CVE-2025-3236 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/VirSerDM… |
CVE-2025-1865 | High | 7.8 | 2025-04-04 | The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows cr… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-3169 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/save… |
CVE-2025-3123 | Medium | 4.7 | 2025-04-02 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the c… |
CVE-2025-31484 | | 2025-04-02 | conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-… | |
CVE-2025-31726 | Medium | 5.5 | 2025-04-02 | Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2025-31725 | Medium | 5.5 | 2025-04-02 | Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Ext… |
CVE-2025-3082 | Low | 3.1 | 2025-04-01 | A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. T… |
CVE-2025-3042 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /studen… |
CVE-2025-3041 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/update… |
CVE-2025-3040 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-31187 | Medium | 5.5 | 2025-03-31 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be a… |
CVE-2025-30462 | Critical | 9.8 | 2025-03-31 | A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. App… |
CVE-2025-30460 | High | 7.4 | 2025-03-31 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, mac… |
CVE-2025-30450 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may… |
CVE-2025-30438 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ven… |
CVE-2025-30433 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14… |
CVE-2025-30425 | Medium | 4.3 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tv… |
CVE-2025-24272 | Medium | 6.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modif… |
CVE-2025-24259 | Critical | 9.8 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7… |
CVE-2025-24248 | Medium | 5.0 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have si… |
CVE-2025-24241 | Critical | 9.8 | 2025-03-31 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app… |
CVE-2025-24236 | Medium | 5.5 | 2025-03-31 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to acces… |
CVE-2025-24229 | High | 7.4 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A sandboxed app may be… |
CVE-2025-24218 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. An app may be able to access inf… |
CVE-2025-24215 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious… |