CWE-284 · Improper Access Control (page 41)
Page 41 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20931 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20929 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are… |
CVE-2024-20927 | High | 8.6 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20911 | Low | 2.6 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-0036 | High | 7.8 | 2024-02-16 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background… |
CVE-2024-0032 | Medium | 6.5 | 2024-02-16 | In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to loca… |
CVE-2023-39244 | High | 7.3 | 2024-02-15 | DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthentica… |
CVE-2024-24386 | High | 7.2 | 2024-02-15 | An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. |
CVE-2024-24300 | Critical | 9.8 | 2024-02-14 | 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, th… |
CVE-2023-40161 | Medium | 6.6 | 2024-02-14 | Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-39941 | High | 7.1 | 2024-02-14 | Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via ad… |
CVE-2023-39432 | Medium | 6.7 | 2024-02-14 | Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticated user to potential… |
CVE-2023-39425 | High | 8.8 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-38561 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-35121 | High | 7.8 | 2024-02-14 | Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow… |
CVE-2023-35062 | Medium | 6.3 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2023-33875 | High | 7.1 | 2024-02-14 | Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to pot… |
CVE-2023-32647 | Medium | 6.8 | 2024-02-14 | Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-31271 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-28715 | Medium | 5.0 | 2024-02-14 | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially e… |
CVE-2023-28396 | Medium | 6.1 | 2024-02-14 | Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privileged user to enable denial of service via… |
CVE-2023-27517 | Medium | 6.6 | 2024-02-14 | Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an athenticated user to… |
CVE-2023-27303 | Low | 3.8 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inform… |
CVE-2023-27301 | Medium | 4.2 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-26596 | Low | 2.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-26585 | Medium | 5.0 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-25777 | High | 7.9 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-25174 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalatio… |
CVE-2023-25073 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2023-24481 | Medium | 6.3 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-22848 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-22311 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 may allow an authenticated user to potenti… |
CVE-2023-22293 | High | 8.2 | 2024-02-14 | Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2023-44283 | High | 7.8 | 2024-02-14 | In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identi… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2023-31346 | Medium | 6.0 | 2024-02-13 | Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. |
CVE-2023-20587 | High | 7.1 | 2024-02-13 | Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution. … |
CVE-2023-20579 | Medium | 6.0 | 2024-02-13 | Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulti… |
CVE-2024-24751 | Medium | 4.3 | 2024-02-13 | sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control c… |
CVE-2024-21401 | Critical | 9.8 | 2024-02-13 | Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability |
CVE-2024-21376 | Critical | 9.0 | 2024-02-13 | Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability |
CVE-2024-21364 | Critical | 9.3 | 2024-02-13 | Microsoft Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2024-20695 | Medium | 5.7 | 2024-02-13 | Skype for Business Information Disclosure Vulnerability |
CVE-2024-1439 | Medium | 6.5 | 2024-02-12 | Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with hig… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-25677 | High | 8.8 | 2024-02-09 | In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For exa… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-0965 | Medium | 5.3 | 2024-02-08 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the RE… |
CVE-2024-24824 | High | 8.8 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and insta… |
CVE-2024-24771 | High | 7.7 | 2024-02-07 | Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication… |
CVE-2024-23447 | Medium | 5.3 | 2024-02-07 | An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write an… |
CVE-2024-23446 | Medium | 6.5 | 2024-02-07 | An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when q… |
CVE-2023-32479 | Medium | 6.7 | 2024-02-06 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerabil… |
CVE-2023-43517 | High | 8.4 | 2024-02-06 | Memory corruption in Automotive Multimedia due to improper access control in HAB. |
CVE-2024-1092 | Medium | 4.3 | 2024-02-05 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modifi… |
CVE-2024-0969 | Medium | 5.3 | 2024-02-05 | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it… |
CVE-2024-0374 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0373 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0371 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0370 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0366 | Medium | 4.3 | 2024-02-05 | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via… |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2021-46903 | Medium | 6.5 | 2024-02-04 | An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete req… |
CVE-2023-44031 | High | 7.5 | 2024-02-03 | Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure… |
CVE-2023-38263 | Medium | 6.5 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID… |
CVE-2023-32333 | Medium | 6.5 | 2024-02-02 | IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls. IBM X-Force ID: 255073. |
CVE-2023-47867 | High | 8.8 | 2024-02-01 | MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compr… |
CVE-2024-1114 | Medium | 6.5 | 2024-01-31 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/… |
CVE-2024-24566 | Medium | 5.3 | 2024-01-31 | Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-prote… |
CVE-2024-21653 | Medium | 6.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and… |
CVE-2024-1011 | Medium | 4.3 | 2024-01-29 | A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delet… |
CVE-2024-0212 | High | 8.1 | 2024-01-29 | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to a… |
CVE-2024-20263 | Medium | 5.8 | 2024-01-26 | A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 35… |
CVE-2024-0810 | Medium | 4.3 | 2024-01-24 | Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2023-40528 | Medium | 5.5 | 2024-01-23 | This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6… |
CVE-2024-23675 | Medium | 6.5 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST applicati… |
CVE-2024-23681 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.load… |
CVE-2024-23331 | High | 7.5 | 2024-01-19 | Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-au… |
CVE-2023-32544 | High | 7.3 | 2024-01-19 | Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an a… |
CVE-2023-47034 | High | 7.5 | 2024-01-19 | A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors. |
CVE-2024-0712 | High | 7.3 | 2024-01-19 | A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2023-20260 | Medium | 6.0 | 2024-01-17 | A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacke… |
CVE-2024-0642 | Critical | 9.8 | 2024-01-17 | Inadequate access control in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to access the application a… |
CVE-2024-22407 | Medium | 4.9 | 2024-01-16 | Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions… |
CVE-2024-20969 | Medium | 5.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20952 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20948 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are affected are 12.2.3… |
CVE-2024-20938 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). Supported versions that are affected are 12.2.3-12.2.13. Easily exploi… |
CVE-2024-20936 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-… |
CVE-2024-20932 | High | 7.5 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20926 | Medium | 5.9 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported ver… |
CVE-2024-20918 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20916 | High | 8.3 | 2024-01-16 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that i… |
CVE-2024-20912 | Low | 2.7 | 2024-01-16 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Easily exploitable vulner… |
CVE-2023-21901 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastruct… |