CWE-284 · Improper Access Control (page 40)
Page 40 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26942 | Critical | 9.1 | 2024-03-21 | An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword op… |
CVE-2024-1473 | Medium | 5.3 | 2024-03-20 | The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the… |
CVE-2024-1144 | Medium | 6.5 | 2024-03-19 | Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user t… |
CVE-2024-20767 | High | 7.4 | 2024-03-18 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2021-47155 | Critical | 9.1 | 2024-03-18 | The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attacke… |
CVE-2022-47037 | High | 7.5 | 2024-03-18 | Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. |
CVE-2022-47036 | Critical | 9.8 | 2024-03-18 | Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be… |
CVE-2024-2481 | Medium | 6.5 | 2024-03-15 | A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2024-28390 | Critical | 9.8 | 2024-03-14 | An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive info… |
CVE-2024-25653 | Medium | 4.3 | 2024-03-14 | Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view sy… |
CVE-2024-20322 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthent… |
CVE-2024-20319 | Medium | 4.3 | 2024-03-13 | A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane pro… |
CVE-2024-20315 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2024-1668 | Medium | 6.5 | 2024-03-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.1… |
CVE-2024-1462 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes… |
CVE-2024-1370 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hoo… |
CVE-2024-0687 | Medium | 5.3 | 2024-03-13 | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu… |
CVE-2024-0631 | Medium | 5.3 | 2024-03-13 | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_respon… |
CVE-2024-0377 | Medium | 5.3 | 2024-03-13 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-0369 | Medium | 4.3 | 2024-03-13 | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2024-28338 | High | 8.0 | 2024-03-12 | A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie. |
CVE-2024-26203 | High | 7.3 | 2024-03-12 | Azure Data Studio Elevation of Privilege Vulnerability |
CVE-2024-26201 | Medium | 6.6 | 2024-03-12 | Microsoft Intune Linux Agent Elevation of Privilege Vulnerability |
CVE-2024-21436 | High | 7.8 | 2024-03-12 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-21418 | High | 7.8 | 2024-03-12 | Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability |
CVE-2023-36554 | High | 8.1 | 2024-03-12 | A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2… |
CVE-2024-21483 | Medium | 4.6 | 2024-03-12 | A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003… |
CVE-2022-32257 | Critical | 9.8 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper… |
CVE-2024-21805 | High | 7.8 | 2024-03-12 | Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is… |
CVE-2024-28120 | Medium | 6.5 | 2024-03-11 | codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender… |
CVE-2024-25501 | High | 8.8 | 2024-03-09 | An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter. |
CVE-2024-2281 | Medium | 6.3 | 2024-03-08 | A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2024-23267 | Medium | 5.5 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to bypa… |
CVE-2024-23266 | Medium | 5.5 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to modi… |
CVE-2024-23238 | Low | 3.3 | 2024-03-08 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables. |
CVE-2024-0258 | High | 8.6 | 2024-03-08 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may… |
CVE-2024-28115 | High | 8.8 | 2024-03-07 | FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege esca… |
CVE-2023-51786 | Critical | 9.1 | 2024-03-07 | An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensitive information v… |
CVE-2023-43318 | High | 8.8 | 2024-03-06 | TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET r… |
CVE-2023-38946 | High | 8.8 | 2024-03-06 | An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the app… |
CVE-2023-38945 | Critical | 9.8 | 2024-03-06 | Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows a… |
CVE-2024-1898 | Medium | 4.3 | 2024-03-05 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings… |
CVE-2024-1478 | Medium | 5.3 | 2024-03-05 | The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This ma… |
CVE-2024-1088 | Medium | 5.3 | 2024-03-05 | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-20036 | Medium | 4.4 | 2024-03-04 | In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges ne… |
CVE-2024-0795 | High | 7.2 | 2024-03-02 | If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating… |
CVE-2023-49545 | High | 7.5 | 2024-03-01 | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiri… |
CVE-2023-49543 | Critical | 9.8 | 2024-03-01 | Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenti… |
CVE-2024-21767 | Critical | 9.4 | 2024-03-01 | A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request. |
CVE-2024-27497 | High | 8.8 | 2024-03-01 | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. |
CVE-2024-1942 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, w… |
CVE-2024-1888 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members… |
CVE-2024-23488 | Low | 3.1 | 2024-02-29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived… |
CVE-2024-1887 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to… |
CVE-2024-25830 | Critical | 9.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can explo… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-1492 | Medium | 5.3 | 2024-02-29 | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function i… |
CVE-2024-1475 | Medium | 5.3 | 2024-02-29 | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST… |
CVE-2024-1472 | Medium | 5.3 | 2024-02-29 | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possi… |
CVE-2024-1294 | Medium | 5.3 | 2024-02-29 | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2024-1288 | Medium | 4.3 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sas… |
CVE-2024-1044 | Medium | 5.3 | 2024-02-29 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_r… |
CVE-2024-0978 | Medium | 5.3 | 2024-02-29 | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This ma… |
CVE-2023-51774 | High | 8.4 | 2024-02-29 | The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can someti… |
CVE-2023-49931 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49930 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2022-34270 | Critical | 9.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager. |
CVE-2024-25169 | Critical | 9.8 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. |
CVE-2024-1632 | High | 8.8 | 2024-02-28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. |
CVE-2024-22459 | Medium | 6.8 | 2024-02-28 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote h… |
CVE-2024-1476 | Medium | 5.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-0975 | Medium | 5.3 | 2024-02-28 | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST AP… |
CVE-2024-0766 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2024-25723 | High | 8.8 | 2024-02-27 | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/acti… |
CVE-2024-0551 | High | 7.1 | 2024-02-27 | Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access… |
CVE-2024-24568 | Medium | 5.3 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTT… |
CVE-2021-33162 | High | 8.4 | 2024-02-23 | Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authenticated user to pote… |
CVE-2024-1823 | Medium | 5.3 | 2024-02-23 | A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-1053 | Medium | 4.3 | 2024-02-22 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in… |
CVE-2024-25251 | High | 8.8 | 2024-02-22 | code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. |
CVE-2024-26310 | Medium | 4.3 | 2024-02-21 | Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploi… |
CVE-2024-20325 | Medium | 5.1 | 2024-02-21 | A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a reposi… |
CVE-2024-1701 | Medium | 5.3 | 2024-02-21 | A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2023-42945 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth. |
CVE-2023-42859 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modi… |
CVE-2023-42853 | Medium | 5.5 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to… |
CVE-2023-42838 | High | 8.6 | 2024-02-21 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app m… |
CVE-2024-1675 | High | 8.8 | 2024-02-21 | Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted H… |
CVE-2023-47422 | High | 8.8 | 2024-02-20 | An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 a… |
CVE-2024-22234 | High | 7.4 | 2024-02-20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly use… |
CVE-2022-45320 | Medium | 6.3 | 2024-02-20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become… |
CVE-2023-6259 | High | 7.1 | 2024-02-19 | Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical… |
CVE-2023-50257 | Critical | 9.6 | 2024-02-19 | eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the applicat… |
CVE-2024-25981 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided… |
CVE-2024-25980 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided addit… |
CVE-2024-1343 | Medium | 4.7 | 2024-02-19 | A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup… |
CVE-2023-52375 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52367 | High | 7.7 | 2024-02-18 | Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrit… |
CVE-2024-20951 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |