CWE-284 · Improper Access Control (page 38)
Page 38 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41324 | Medium | 6.5 | 2024-06-20 | Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensiti… |
CVE-2024-38273 | Medium | 5.4 | 2024-06-18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
CVE-2022-23829 | High | 8.2 | 2024-06-18 | A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode… |
CVE-2024-5650 | High | 8.5 | 2024-06-17 | DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into… |
CVE-2024-37887 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that t… |
CVE-2024-37884 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with… |
CVE-2024-37883 | Medium | 4.3 | 2024-06-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2024-37317 | Medium | 4.6 | 2024-06-14 | The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created use… |
CVE-2024-37315 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the f… |
CVE-2024-37314 | Low | 3.5 | 2024-06-14 | Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded… |
CVE-2024-37312 | Medium | 6.3 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventuall… |
CVE-2024-37279 | Medium | 4.3 | 2024-06-13 | A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting… |
CVE-2024-28969 | Medium | 4.3 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28968 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST API… |
CVE-2024-28967 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by… |
CVE-2024-28966 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28965 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by Admi… |
CVE-2024-34112 | High | 7.5 | 2024-06-13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2024-34107 | Medium | 5.3 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Securit… |
CVE-2024-26029 | High | 7.5 | 2024-06-13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A… |
CVE-2024-5840 | Medium | 6.5 | 2024-06-11 | Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromi… |
CVE-2024-29060 | Medium | 6.7 | 2024-06-11 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2024-5687 | Medium | 5.3 | 2024-06-11 | If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The trigge… |
CVE-2024-37289 | High | 7.8 | 2024-06-10 | An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2024-27855 | High | 8.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, macOS Ventura 1… |
CVE-2024-27819 | Low | 2.4 | 2024-06-10 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access ma… |
CVE-2024-27792 | Medium | 5.5 | 2024-06-10 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive… |
CVE-2022-48683 | High | 7.8 | 2024-06-10 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may be able to break out of its sandbox. |
CVE-2024-37568 | High | 7.5 | 2024-06-09 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is a… |
CVE-2024-30481 | Medium | 6.5 | 2024-06-09 | Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0. |
CVE-2023-6491 | Medium | 4.3 | 2024-06-07 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sti… |
CVE-2024-22074 | Critical | 9.8 | 2024-06-06 | Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1… |
CVE-2024-36399 | High | 8.2 | 2024-06-06 | Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(… |
CVE-2024-0972 | Medium | 5.3 | 2024-06-06 | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API… |
CVE-2023-6968 | High | 8.1 | 2024-06-06 | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or inco… |
CVE-2023-6966 | High | 8.1 | 2024-06-06 | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check… |
CVE-2024-28818 | Medium | 5.9 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280… |
CVE-2024-2019 | High | 7.5 | 2024-06-04 | The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capab… |
CVE-2024-23360 | High | 8.4 | 2024-06-03 | Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers. |
CVE-2024-20065 | Medium | 4.0 | 2024-06-03 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2024-35433 | High | 8.1 | 2024-05-30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new adm… |
CVE-2024-0434 | Medium | 5.3 | 2024-05-29 | The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2023-43849 | Medium | 6.5 | 2024-05-28 | Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmwar… |
CVE-2023-43848 | High | 8.0 | 2024-05-28 | Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter loc… |
CVE-2023-43847 | Medium | 5.3 | 2024-05-28 | Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all th… |
CVE-2024-23315 | High | 7.5 | 2024-05-28 | A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specia… |
CVE-2024-22187 | Critical | 9.1 | 2024-05-28 | A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A… |
CVE-2023-52712 | High | 7.8 | 2024-05-28 | Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previou… |
CVE-2023-52711 | High | 7.8 | 2024-05-28 | Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previou… |
CVE-2024-5272 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event… |
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-1376 | Medium | 4.3 | 2024-05-24 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all… |
CVE-2024-35222 | Medium | 5.9 | 2024-05-23 | Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints with… |
CVE-2024-5168 | Critical | 9.8 | 2024-05-23 | Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated use… |
CVE-2024-26139 | High | 8.3 | 2024-05-23 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security… |
CVE-2024-32969 | Low | 2.7 | 2024-05-23 | vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that… |
CVE-2024-22026 | Medium | 6.7 | 2024-05-22 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary command… |
CVE-2024-27264 | High | 7.4 | 2024-05-22 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-20261 | Medium | 5.8 | 2024-05-22 | A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2024-33227 | High | 8.8 | 2024-05-22 | An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IO… |
CVE-2024-0453 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback fun… |
CVE-2024-0452 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback fun… |
CVE-2024-0451 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in… |
CVE-2023-52801 | High | 8.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split… |
CVE-2024-4988 | High | 7.5 | 2024-05-21 | The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage. |
CVE-2024-36080 | Critical | 9.8 | 2024-05-19 | Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is a serial-to-Etherne… |
CVE-2024-21828 | Medium | 6.7 | 2024-05-16 | Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially e… |
CVE-2023-47859 | Medium | 5.5 | 2024-05-16 | Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to potentially enable de… |
CVE-2023-45217 | High | 8.8 | 2024-05-16 | Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-43748 | High | 7.8 | 2024-05-16 | Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalati… |
CVE-2023-43487 | Medium | 4.7 | 2024-05-16 | Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2023-40071 | High | 7.3 | 2024-05-16 | Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-40070 | High | 8.8 | 2024-05-16 | Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-39433 | Medium | 4.4 | 2024-05-16 | Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-37410 | High | 7.0 | 2024-05-16 | Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-37341 | High | 7.2 | 2024-05-16 | Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentia… |
CVE-2024-4263 | Medium | 5.4 | 2024-05-16 | A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can… |
CVE-2024-28087 | Medium | 6.5 | 2024-05-15 | In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition an… |
CVE-2024-34099 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code exe… |
CVE-2024-0437 | Medium | 4.3 | 2024-05-15 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Expos… |
CVE-2024-30059 | Medium | 6.1 | 2024-05-14 | Microsoft Intune for Android Mobile Application Management Tampering Vulnerability |
CVE-2024-33647 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper acc… |
CVE-2024-2749 | Medium | 5.9 | 2024-05-14 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permittin… |
CVE-2024-27841 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An app may be able to disclose kerne… |
CVE-2024-27803 | Low | 2.4 | 2024-05-14 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to sh… |
CVE-2024-27790 | High | 7.5 | 2024-05-14 | Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue ha… |
CVE-2024-1230 | Medium | 4.3 | 2024-05-14 | The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorre… |
CVE-2022-32507 | High | 8.8 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts… |
CVE-2024-0025 | High | 7.8 | 2024-05-07 | In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of… |
CVE-2024-29207 | High | 7.5 | 2024-05-07 | An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: Uni… |
CVE-2024-29206 | Low | 2.2 | 2024-05-07 | An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the syst… |
CVE-2023-6810 | Medium | 4.3 | 2024-05-07 | The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings… |
CVE-2024-23351 | High | 8.4 | 2024-05-06 | Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. |