CWE-284 · Improper Access Control (page 36)
Page 36 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46627 | Critical | 9.1 | 2024-09-26 | Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. |
CVE-2024-45982 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password res… |
CVE-2024-44860 | High | 7.5 | 2024-09-26 | An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request. |
CVE-2024-41605 | High | 8.4 | 2024-09-26 | In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan horse via side loa… |
CVE-2024-47145 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker… |
CVE-2024-42406 | Medium | 5.4 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is… |
CVE-2024-20465 | Medium | 5.8 | 2024-09-25 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches co… |
CVE-2024-46610 | High | 7.5 | 2024-09-25 | An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted P… |
CVE-2024-46609 | High | 7.5 | 2024-09-25 | An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all… |
CVE-2024-46607 | High | 7.6 | 2024-09-25 | Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the log… |
CVE-2024-42797 | Critical | 9.8 | 2024-09-25 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability all… |
CVE-2024-45489 | Critical | 9.8 | 2024-09-20 | Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigu… |
CVE-2024-9003 | Medium | 4.3 | 2024-09-19 | A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController o… |
CVE-2024-38016 | High | 7.8 | 2024-09-19 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2024-45811 | Medium | 4.8 | 2024-09-17 | Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies acces… |
CVE-2024-40825 | Medium | 4.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with root privileges may be able to modify t… |
CVE-2024-42796 | Medium | 5.9 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows… |
CVE-2024-42795 | Medium | 4.2 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management Sy… |
CVE-2024-42794 | Medium | 4.7 | 2024-09-16 | Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user. |
CVE-2024-36261 | Low | 3.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent… |
CVE-2024-36247 | Medium | 4.6 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access. |
CVE-2024-34543 | Medium | 6.7 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-32940 | Medium | 6.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adja… |
CVE-2024-28170 | Low | 3.3 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2023-43626 | High | 7.5 | 2024-09-16 | Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acces… |
CVE-2024-39772 | Low | 3.7 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots vi… |
CVE-2024-8779 | High | 8.8 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privil… |
CVE-2024-8269 | High | 7.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and… |
CVE-2024-44571 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php. |
CVE-2024-20343 | Medium | 5.5 | 2024-09-11 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux op… |
CVE-2024-43492 | High | 7.8 | 2024-09-10 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2024-43479 | High | 8.5 | 2024-09-10 | Microsoft Power Automate Desktop Remote Code Execution Vulnerability |
CVE-2024-38220 | Critical | 9.0 | 2024-09-10 | Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2024-37341 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2023-37234 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum through 4.6 has unprotected JMX Registry. |
CVE-2024-45323 | Medium | 4.3 | 2024-09-10 | An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an a… |
CVE-2024-37993 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-39580 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could pote… |
CVE-2024-6796 | High | 8.2 | 2024-09-09 | In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker… |
CVE-2024-42023 | High | 8.8 | 2024-09-07 | An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. |
CVE-2024-42022 | Medium | 5.3 | 2024-09-07 | An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. |
CVE-2024-42021 | Medium | 6.5 | 2024-09-07 | An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. |
CVE-2023-30587 | High | 7.5 | 2024-09-07 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:ins… |
CVE-2023-30583 | High | 7.5 | 2024-09-07 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This fl… |
CVE-2023-30582 | Medium | 5.3 | 2024-09-07 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2024-45392 | High | 7.7 | 2024-09-05 | SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat… |
CVE-2024-45170 | High | 8.1 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-45522 | Critical | 9.8 | 2024-09-02 | Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgo… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-45233 | Critical | 9.8 | 2024-08-29 | An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insu… |
CVE-2024-44915 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44914 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44913 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-20279 | Medium | 4.3 | 2024-08-28 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2024-8216 | Medium | 5.4 | 2024-08-27 | A vulnerability, which was classified as critical, has been found in nafisulbari/itsourcecode Insurance Management System 1.0. Affected by this issue is some u… |
CVE-2024-5814 | Medium | 5.3 | 2024-08-27 | A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection… |
CVE-2024-36068 | Critical | 9.8 | 2024-08-27 | An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute a… |
CVE-2024-8164 | Medium | 6.3 | 2024-08-26 | A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controll… |
CVE-2024-43031 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 was discovered to contain an access control issue. |
CVE-2024-42766 | Medium | 5.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. |
CVE-2024-40766 | Critical | 9.8 | 2024-08-23 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an… |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |
CVE-2024-42776 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. |
CVE-2024-42775 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticate… |
CVE-2024-42772 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to… |
CVE-2024-43780 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload fil… |
CVE-2024-42497 | Medium | 6.0 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems mana… |
CVE-2024-40884 | Low | 2.7 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission… |
CVE-2024-3127 | Medium | 4.3 | 2024-08-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions… |
CVE-2024-36441 | Medium | 5.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by th… |
CVE-2024-36443 | High | 7.6 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP. |
CVE-2024-8071 | Medium | 4.7 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which a… |
CVE-2024-43813 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |
CVE-2024-38175 | Critical | 9.6 | 2024-08-20 | An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a netwo… |
CVE-2024-42919 | Critical | 9.8 | 2024-08-20 | eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. |
CVE-2024-27187 | High | 7.5 | 2024-08-20 | Improper Access Controls allows backend users to overwrite their username when disallowed. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-43397 | Medium | 4.3 | 2024-08-20 | Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests t… |
CVE-2024-43377 | Medium | 5.4 | 2024-08-20 | Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. |
CVE-2024-42559 | Critical | 9.8 | 2024-08-20 | An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid passwor… |
CVE-2024-7921 | Medium | 4.3 | 2024-08-19 | A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this… |
CVE-2024-7920 | Medium | 4.3 | 2024-08-19 | A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is a… |
CVE-2024-7919 | Medium | 5.3 | 2024-08-19 | A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue… |
CVE-2024-6221 | High | 7.5 | 2024-08-18 | A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavi… |
CVE-2024-42967 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-28050 | Medium | 5.0 | 2024-08-14 | Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially ena… |
CVE-2024-26022 | High | 7.8 | 2024-08-14 | Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated user to potentially enable escalation of… |
CVE-2024-25576 | High | 7.9 | 2024-08-14 | improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to enable escalation of privilege via local… |
CVE-2024-24986 | High | 8.8 | 2024-08-14 | Improper access control in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated… |
CVE-2023-43489 | Medium | 5.5 | 2024-08-14 | Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to potentially enable denial of service via loc… |
CVE-2024-39414 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-38163 | High | 7.8 | 2024-08-14 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-38223 | Medium | 6.8 | 2024-08-13 | Windows Initial Machine Configuration Elevation of Privilege Vulnerability |
CVE-2024-38195 | High | 7.8 | 2024-08-13 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-38162 | High | 7.8 | 2024-08-13 | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
CVE-2023-31341 | High | 7.3 | 2024-08-13 | Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of-bounds write, pote… |
CVE-2024-36505 | Medium | 5.1 | 2024-08-13 | An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker w… |