CWE-284 · Improper Access Control (page 39)

Page 39 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-284 — newest first (page 39 of 64)
CVESeverityScorePublishedSummary
CVE-2024-34068Medium6.42024-05-03Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp…
CVE-2024-34404Medium6.82024-05-03A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the clou…
CVE-2024-33396High8.42024-05-02An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVE-2024-1678Medium5.32024-05-02The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST…
CVE-2024-1584Medium5.32024-05-02The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modification of data due…
CVE-2024-31967Critical9.12024-05-02A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1…
CVE-2024-31964High7.52024-05-02A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1…
CVE-2024-33393Medium6.22024-05-01An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVE-2024-22830Medium5.32024-05-01Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allo…
CVE-2024-32973Medium4.82024-05-01Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network tra…
CVE-2024-28978Medium5.22024-05-01Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. A high privileged remote attacker could potentially explo…
CVE-2024-3746Medium5.52024-04-30The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write o…
CVE-2023-49473Critical9.82024-04-30Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access…
CVE-2024-4225High7.62024-04-30Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit (RTU), by DPS Telecom. Attackers can exploit th…
CVE-2024-33260Medium5.12024-04-26Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c
CVE-2024-4198Low2.72024-04-26Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin…
CVE-2024-4195Low2.72024-04-26Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team ad…
CVE-2024-33673High7.82024-04-26An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path.
CVE-2024-33666High8.62024-04-26An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API…
CVE-2024-23271Medium6.52024-04-24A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A m…
CVE-2023-38298High8.82024-04-22Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on…
CVE-2023-38297High8.42024-04-22An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for var…
CVE-2023-38296High8.02024-04-22Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w…
CVE-2024-27348Critical9.82024-04-22RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Us…
CVE-2024-22811High8.22024-04-22An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between…
CVE-2024-22807Medium6.52024-04-22An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose…
CVE-2024-32418Critical9.82024-04-22An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.
CVE-2024-31846High7.52024-04-19An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from an unauthorized acto…
CVE-2024-30107Low3.52024-04-18HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
CVE-2023-45744High8.32024-04-17A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially craft…
CVE-2023-45209Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A spec…
CVE-2023-43491Medium5.32024-04-17An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially…
CVE-2024-31503High7.52024-04-17Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protect…
CVE-2024-31759High8.82024-04-16An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
CVE-2024-21115High8.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21114High8.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21113High8.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21112High8.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21110High7.32024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21107Medium6.72024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21103High7.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily…
CVE-2024-21091Medium6.52024-04-16Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Data Import). The supported version tha…
CVE-2024-21084Medium5.82024-04-16Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Service Gateway). Supported versions that are affected are 7.0.0.0.0 and 12…
CVE-2024-21076High7.52024-04-16Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Offer LOV). Supported versions that are affected are 12.2.3-12.2.1…
CVE-2024-21074High7.52024-04-16Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Finance LOV). Supported versions that are affected are 12.2.3-12.2…
CVE-2024-21071Critical9.12024-04-16Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12…
CVE-2024-21067High8.82024-04-16Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). The supported version that is…
CVE-2024-20992Medium4.42024-04-16Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). The supported version that is affected is…
CVE-2024-24487Medium6.82024-04-15An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC RE…
CVE-2024-24486Critical9.12024-04-15An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command.
CVE-2024-24485High7.52024-04-15An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command.
CVE-2024-29843High7.52024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing f…
CVE-2024-29842High7.52024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIE…
CVE-2024-29841High7.52024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS…
CVE-2024-29840High7.52024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS…
CVE-2024-29839High7.52024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allow…
CVE-2024-29837High8.82024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce…
CVE-2024-29836Critical9.82024-04-15The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated att…
CVE-2024-3765Critical9.82024-04-14A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R8…
CVE-2024-25852High8.82024-04-11Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. A…
CVE-2024-2217High7.52024-04-10gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in b…
CVE-2024-2731Medium5.42024-04-10Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such…
CVE-2024-1308High7.52024-04-09The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permali…
CVE-2024-0899Medium5.32024-04-09The s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerab…
CVE-2024-0626Medium5.32024-04-09The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callbac…
CVE-2024-29993High8.82024-04-09Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2024-29990Critical9.02024-04-09Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVE-2024-29055High7.22024-04-09Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-29054High7.22024-04-09Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-28922Medium4.12024-04-09Secure Boot Security Feature Bypass Vulnerability
CVE-2024-28917Medium6.22024-04-09Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability
CVE-2024-26234Medium6.72024-04-09Proxy Driver Spoofing Vulnerability
CVE-2024-21424Medium6.52024-04-09Azure Compute Gallery Elevation of Privilege Vulnerability
CVE-2024-31805Medium6.52024-04-08TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg f…
CVE-2024-27895High7.52024-04-08Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2023-52537High7.52024-04-08Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.
CVE-2024-30418High7.52024-04-07Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availabil…
CVE-2024-2447Medium6.52024-04-05Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos…
CVE-2024-29221Medium4.72024-04-05Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access cont…
CVE-2024-21848Low3.12024-04-05Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in…
CVE-2024-31207Medium5.92024-04-04Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does…
CVE-2024-30261Low2.62024-04-04Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept…
CVE-2023-36644High7.52024-04-04Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin.
CVE-2023-36643High7.52024-04-04Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer fun…
CVE-2024-1418Medium5.32024-04-04The CGC Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 via the REST API. This…
CVE-2024-3270Low3.82024-04-03A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The m…
CVE-2024-20302Medium5.42024-04-03A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or de…
CVE-2024-20283Medium4.32024-04-03A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This v…
CVE-2024-27605High7.52024-04-02Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.
CVE-2024-27602Critical9.12024-04-02Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs…
CVE-2024-3164Medium4.52024-04-01In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone wi…
CVE-2024-28405High7.22024-03-29SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page becau…
CVE-2024-28960High8.22024-03-29An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.
CVE-2024-28016Medium6.02024-03-28Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-M…
CVE-2024-25962High8.32024-03-27Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could potentially exploit this vulnerability…
CVE-2024-25736High7.52024-03-27An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.
CVE-2023-50702High8.82024-03-26Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write acc…
CVE-2024-29866Critical9.12024-03-21Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System…
CVE-2024-25811Medium6.52024-03-21An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.
CVE-2023-49978High8.82024-03-21Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administr…