CWE-284 · Improper Access Control (page 37)
Page 37 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41905 | Medium | 6.8 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control f… |
CVE-2024-41732 | Medium | 4.7 | 2024-08-13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web app… |
CVE-2024-42480 | High | 8.1 | 2024-08-12 | Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd ro… |
CVE-2024-41332 | Medium | 6.5 | 2024-08-12 | Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-l… |
CVE-2024-40480 | Critical | 9.8 | 2024-08-12 | A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthe… |
CVE-2024-40475 | High | 8.8 | 2024-08-12 | SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /… |
CVE-2024-29082 | High | 8.6 | 2024-08-12 | Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enab… |
CVE-2024-0104 | Medium | 4.2 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A success… |
CVE-2024-42354 | Medium | 5.3 | 2024-08-08 | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiA… |
CVE-2024-42033 | Medium | 6.9 | 2024-08-08 | Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-38202 | High | 7.3 | 2024-08-08 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileg… |
CVE-2024-21302 | Medium | 6.7 | 2024-08-08 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-… |
CVE-2024-41912 | Critical | 9.8 | 2024-08-07 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access con… |
CVE-2024-41250 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41245 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41244 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41243 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41309 | High | 7.8 | 2024-08-07 | An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privi… |
CVE-2024-41308 | High | 7.8 | 2024-08-07 | An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on… |
CVE-2024-41252 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kaship… |
CVE-2024-41251 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kaship… |
CVE-2024-41249 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unau… |
CVE-2024-41248 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System… |
CVE-2024-41247 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2… |
CVE-2024-41246 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote u… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-7525 | High | 8.1 | 2024-08-06 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on… |
CVE-2024-40531 | High | 8.8 | 2024-08-05 | A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, includin… |
CVE-2024-33027 | High | 8.4 | 2024-08-05 | Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table. |
CVE-2024-41518 | High | 7.5 | 2024-08-02 | An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX fi… |
CVE-2024-41926 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malici… |
CVE-2024-41162 | Medium | 4.1 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when sha… |
CVE-2024-41144 | Medium | 5.5 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, w… |
CVE-2024-39839 | Medium | 4.3 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channel… |
CVE-2024-39837 | Low | 3.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, whe… |
CVE-2024-39777 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels… |
CVE-2024-39274 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync messa… |
CVE-2024-36492 | High | 7.4 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in share… |
CVE-2024-29977 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remot… |
CVE-2024-5331 | Medium | 4.3 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authen… |
CVE-2024-38909 | Critical | 9.8 | 2024-07-30 | Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrar… |
CVE-2024-40822 | Low | 2.4 | 2024-07-29 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macO… |
CVE-2024-40812 | High | 7.8 | 2024-07-29 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS S… |
CVE-2024-40786 | High | 7.5 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8… |
CVE-2023-42957 | Low | 3.3 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10. An app may be able to… |
CVE-2024-28805 | Critical | 9.1 | 2024-07-29 | An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control. |
CVE-2024-6727 | Medium | 5.4 | 2024-07-29 | A flaw in versions of Delphix Data Control Tower (DCT) prior to 19.0.0 results in broken authentication through the enable-scale-testing functionality of the a… |
CVE-2024-7154 | Medium | 4.3 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.h… |
CVE-2024-40117 | Critical | 9.8 | 2024-07-26 | Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the we… |
CVE-2024-41806 | Medium | 5.3 | 2024-07-25 | The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor da… |
CVE-2024-7057 | Medium | 4.3 | 2024-07-25 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and star… |
CVE-2024-36535 | Critical | 9.8 | 2024-07-24 | Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36537 | High | 7.2 | 2024-07-24 | Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-38164 | Critical | 9.6 | 2024-07-23 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on… |
CVE-2024-41703 | Critical | 9.8 | 2024-07-22 | LibreChat through 0.7.4-rc1 has incorrect access control for message updates. |
CVE-2024-41600 | High | 7.5 | 2024-07-19 | Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in th… |
CVE-2024-21169 | Medium | 6.5 | 2024-07-16 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Partners). Supported versions that are affected are 12.2.3-12.2.13. Easil… |
CVE-2024-21153 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). The supported… |
CVE-2024-21150 | Medium | 6.1 | 2024-07-16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2024-21145 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |
CVE-2024-21132 | Medium | 5.4 | 2024-07-16 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.13. Eas… |
CVE-2019-16640 | High | 7.5 | 2024-07-16 | An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not ch… |
CVE-2024-37386 | Medium | 4.2 | 2024-07-15 | An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in s… |
CVE-2024-36438 | High | 7.3 | 2024-07-15 | eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to card duplication and… |
CVE-2024-6738 | Medium | 5.3 | 2024-07-15 | The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modi… |
CVE-2024-6737 | High | 8.8 | 2024-07-15 | The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regu… |
CVE-2024-40547 | Medium | 6.5 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
CVE-2024-6385 | Critical | 9.6 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-5257 | Medium | 4.9 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `ad… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-37147 | Medium | 4.3 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-34725 | High | 7.0 | 2024-07-09 | In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of pri… |
CVE-2024-31320 | High | 7.8 | 2024-07-09 | In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This cou… |
CVE-2024-38100 | High | 7.8 | 2024-07-09 | Windows File Explorer Elevation of Privilege Vulnerability |
CVE-2024-38061 | High | 7.5 | 2024-07-09 | DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability |
CVE-2024-23663 | High | 8.8 | 2024-07-09 | An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to… |
CVE-2023-50181 | Medium | 4.9 | 2024-07-09 | An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker… |
CVE-2024-39697 | High | 8.6 | 2024-07-09 | phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic… |
CVE-2024-39701 | Medium | 6.3 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evalua… |
CVE-2024-39943 | Critical | 9.9 | 2024-07-04 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload pe… |
CVE-2024-39934 | High | 7.8 | 2024-07-04 | Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotre… |
CVE-2024-6428 | Medium | 5.3 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attack… |
CVE-2024-39361 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an a… |
CVE-2024-36257 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A request… |
CVE-2024-36989 | High | 7.1 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold th… |
CVE-2024-38518 | Medium | 4.6 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick… |
CVE-2024-38371 | High | 8.6 | 2024-06-28 | authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This cou… |
CVE-2024-37905 | High | 8.8 | 2024-06-28 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin… |
CVE-2024-39376 | Critical | 9.8 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to users gaining unauthorized access to sensitive information or performing actions beyond their designated permi… |
CVE-2024-5655 | Critical | 9.6 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-5430 | Medium | 6.8 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-2191 | Medium | 5.3 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-37742 | High | 8.2 | 2024-06-25 | Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode… |
CVE-2024-21741 | Critical | 9.8 | 2024-06-25 | GigaDevice GD32E103C8T6 devices have Incorrect Access Control. |
CVE-2024-21740 | High | 7.4 | 2024-06-25 | Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. |
CVE-2024-33898 | Critical | 9.8 | 2024-06-24 | Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote atta… |
CVE-2024-37677 | High | 7.5 | 2024-06-24 | An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information. |
CVE-2024-38873 | Medium | 5.3 | 2024-06-21 | An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check th… |
CVE-2022-45929 | High | 8.8 | 2024-06-20 | Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and cou… |