CWE-284 · Improper Access Control (page 42)
Page 42 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0570 | High | 7.3 | 2024-01-16 | A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2023-52105 | High | 7.5 | 2024-01-16 | The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52099 | High | 7.5 | 2024-01-16 | Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2023-52114 | High | 7.5 | 2024-01-16 | Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2024-22209 | Medium | 6.4 | 2024-01-13 | Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints e… |
CVE-2023-51070 | High | 7.5 | 2024-01-13 | An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily adjust sensitive SMB set… |
CVE-2023-51065 | High | 7.5 | 2024-01-13 | Incorrect access control in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to obtain system backups and other sen… |
CVE-2023-49099 | Low | 3.1 | 2024-01-12 | Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users ev… |
CVE-2023-49098 | Low | 3.5 | 2024-01-12 | Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerab… |
CVE-2024-22206 | Critical | 9.0 | 2024-01-12 | Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the P… |
CVE-2024-21589 | High | 7.4 | 2024-01-12 | An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to a… |
CVE-2024-20675 | Medium | 6.3 | 2024-01-11 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-0415 | Medium | 6.3 | 2024-01-11 | A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file applicat… |
CVE-2024-0414 | Medium | 5.3 | 2024-01-11 | A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The… |
CVE-2024-0413 | Medium | 5.3 | 2024-01-11 | A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file public/install… |
CVE-2024-0412 | Medium | 5.3 | 2024-01-11 | A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/instal… |
CVE-2024-0411 | Medium | 5.3 | 2024-01-11 | A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file public/install.php of… |
CVE-2023-51751 | Medium | 6.8 | 2024-01-11 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the… |
CVE-2023-50159 | High | 8.8 | 2024-01-11 | In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in… |
CVE-2023-6582 | Medium | 5.3 | 2024-01-11 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_… |
CVE-2024-21667 | Medium | 6.5 | 2024-01-11 | pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can… |
CVE-2024-21666 | Medium | 6.5 | 2024-01-11 | The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An… |
CVE-2024-21665 | Medium | 4.3 | 2024-01-11 | ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able… |
CVE-2023-28197 | Low | 3.3 | 2024-01-10 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An… |
CVE-2022-42816 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file s… |
CVE-2023-46712 | High | 7.2 | 2024-01-10 | A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its… |
CVE-2023-41603 | Medium | 5.3 | 2024-01-10 | D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services runnin… |
CVE-2022-46025 | Critical | 9.1 | 2024-01-10 | Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, suc… |
CVE-2024-0358 | Medium | 5.3 | 2024-01-10 | A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The… |
CVE-2024-0356 | Medium | 4.3 | 2024-01-10 | A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-20657 | High | 7.0 | 2024-01-09 | Windows Group Policy Elevation of Privilege Vulnerability |
CVE-2023-7223 | Medium | 5.3 | 2024-01-09 | A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi… |
CVE-2023-49961 | High | 7.5 | 2024-01-08 | WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure. |
CVE-2024-21644 | High | 7.5 | 2024-01-08 | pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, i… |
CVE-2023-29051 | High | 8.1 | 2024-01-08 | User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default… |
CVE-2024-22216 | Critical | 10.0 | 2024-01-08 | In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system mana… |
CVE-2023-6733 | Medium | 6.5 | 2024-01-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem… |
CVE-2023-50344 | Medium | 5.4 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files. |
CVE-2023-50343 | High | 8.3 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users t… |
CVE-2023-50341 | High | 7.6 | 2024-01-03 | HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Mi… |
CVE-2023-50333 | Low | 3.7 | 2024-01-02 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group nam… |
CVE-2023-47858 | Medium | 4.3 | 2024-01-02 | Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archiv… |
CVE-2023-7193 | Medium | 4.6 | 2023-12-31 | A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of… |
CVE-2023-50928 | High | 7.1 | 2023-12-22 | "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticate… |
CVE-2023-49791 | Medium | 5.4 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-51661 | High | 8.4 | 2023-12-22 | Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the fil… |
CVE-2022-39337 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1… |
CVE-2023-7055 | Medium | 4.3 | 2023-12-22 | A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profi… |
CVE-2023-50783 | Medium | 6.5 | 2023-12-21 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a varia… |
CVE-2023-7025 | High | 7.8 | 2023-12-21 | A vulnerability was found in KylinSoft hedron-domain-hook up to 3.8.0.12-0k0.5. It has been declared as critical. This vulnerability affects the function init_… |
CVE-2023-51390 | Medium | 6.5 | 2023-12-21 | journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out… |
CVE-2023-50706 | Medium | 4.1 | 2023-12-20 | A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract… |
CVE-2023-6930 | Critical | 9.4 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 suffer from an unauthenticated configuration and log download vulnerability. This enables the attacker to d… |
CVE-2019-25157 | Medium | 4.3 | 2023-12-19 | A vulnerability was found in Ethex Contracts. It has been classified as critical. This affects an unknown part of the file EthexJackpot.sol of the component Mo… |
CVE-2023-51384 | Medium | 5.5 | 2023-12-18 | In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of… |
CVE-2022-41677 | Medium | 5.3 | 2023-12-18 | An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabiliti… |
CVE-2023-48441 | Medium | 5.3 | 2023-12-15 | Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Access Control vulnerability. An attacker could leverage this vulnerability to… |
CVE-2023-21751 | Medium | 6.5 | 2023-12-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-50440 | Medium | 5.5 | 2023-12-13 | ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submi… |
CVE-2023-6773 | Medium | 4.3 | 2023-12-13 | A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-6761 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component… |
CVE-2023-6758 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/Pl… |
CVE-2023-47325 | Medium | 5.4 | 2023-12-13 | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, re… |
CVE-2023-47536 | Low | 3.1 | 2023-12-13 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 an… |
CVE-2023-47579 | High | 7.5 | 2023-12-13 | Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system. |
CVE-2023-6547 | Low | 3.7 | 2023-12-12 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to th… |
CVE-2023-49874 | Medium | 4.3 | 2023-12-12 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playboo… |
CVE-2022-48615 | Medium | 4.8 | 2023-12-12 | An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information. |
CVE-2023-6578 | High | 7.3 | 2023-12-07 | A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/… |
CVE-2023-45210 | Medium | 4.3 | 2023-12-06 | Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files… |
CVE-2023-2861 | Medium | 6.0 | 2023-12-06 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, poten… |
CVE-2023-33071 | High | 8.4 | 2023-12-05 | Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities. |
CVE-2023-39257 | High | 7.3 | 2023-12-02 | Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-39256 | High | 7.3 | 2023-12-02 | Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-43089 | Medium | 4.4 | 2023-12-01 | Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially ex… |
CVE-2023-49694 | High | 7.8 | 2023-11-29 | A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomc… |
CVE-2023-32065 | Medium | 5.8 | 2023-11-28 | OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Or… |
CVE-2023-32064 | Medium | 5.0 | 2023-11-28 | OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Custo… |
CVE-2023-32063 | Medium | 5.0 | 2023-11-28 | OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypas… |
CVE-2023-32062 | Medium | 5.0 | 2023-11-27 | OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing A… |
CVE-2023-6202 | Medium | 4.3 | 2023-11-27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of… |
CVE-2023-47865 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to ove… |
CVE-2023-44290 | High | 7.3 | 2023-11-23 | Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-44289 | High | 7.3 | 2023-11-23 | Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-43086 | High | 7.3 | 2023-11-23 | Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files i… |
CVE-2023-39253 | High | 7.3 | 2023-11-23 | Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator… |
CVE-2023-5299 | High | 7.3 | 2023-11-22 | A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. |
CVE-2023-48303 | Low | 2.4 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-48239 | High | 8.5 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1… |
CVE-2023-26347 | High | 7.5 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Securi… |
CVE-2023-44292 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-44282 | Medium | 6.7 | 2023-11-16 | Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could… |
CVE-2023-39259 | High | 7.3 | 2023-11-16 | Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator… |
CVE-2023-31100 | High | 8.4 | 2023-11-15 | Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technol… |
CVE-2023-41570 | Medium | 5.3 | 2023-11-14 | MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. |
CVE-2023-39228 | Medium | 5.3 | 2023-11-14 | Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2023-39221 | Medium | 5.4 | 2023-11-14 | Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-38411 | Low | 3.9 | 2023-11-14 | Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2023-33872 | Medium | 5.5 | 2023-11-14 | Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable information disclosure via l… |
CVE-2023-32279 | High | 7.5 | 2023-11-14 | Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.2 may allow unauthenticated user to pote… |