CWE-284 · Improper Access Control (page 43)
Page 43 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32204 | High | 8.8 | 2023-11-14 | Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-29157 | High | 8.4 | 2023-11-14 | Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-28397 | High | 7.8 | 2023-11-14 | Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via… |
CVE-2023-27879 | Medium | 6.8 | 2023-11-14 | Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure vi… |
CVE-2023-22448 | Medium | 5.9 | 2023-11-14 | Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network access. |
CVE-2023-22285 | High | 7.5 | 2023-11-14 | Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2022-41689 | High | 7.3 | 2023-11-14 | Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated user to potentially enable escalation of… |
CVE-2022-41659 | Low | 1.9 | 2023-11-14 | Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. |
CVE-2022-38786 | Medium | 6.7 | 2023-11-14 | Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalati… |
CVE-2022-36396 | High | 8.2 | 2023-11-14 | Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.0017 may allow a privileged user to pote… |
CVE-2022-36374 | High | 7.5 | 2023-11-14 | Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privileged user to potent… |
CVE-2023-44248 | Medium | 4.4 | 2023-11-14 | An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007 and below, 4.0 all may allow a local at… |
CVE-2023-36404 | Medium | 5.5 | 2023-11-14 | Windows Kernel Information Disclosure Vulnerability |
CVE-2023-26205 | High | 8.1 | 2023-11-14 | An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may… |
CVE-2023-46601 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This cou… |
CVE-2023-43505 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker… |
CVE-2023-43901 | Medium | 5.9 | 2023-11-14 | Incorrect access control in the AdHoc User creation form of EMSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by… |
CVE-2023-6073 | Medium | 5.7 | 2023-11-10 | Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) an… |
CVE-2023-5543 | Low | 3.3 | 2023-11-09 | When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unint… |
CVE-2023-5549 | Low | 3.3 | 2023-11-09 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capa… |
CVE-2023-5542 | Low | 3.3 | 2023-11-09 | Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
CVE-2023-47110 | Critical | 9.1 | 2023-11-09 | blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in mod… |
CVE-2023-46759 | High | 7.5 | 2023-11-08 | Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46755 | Medium | 5.3 | 2023-11-08 | Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart. |
CVE-2023-46501 | Critical | 9.1 | 2023-11-07 | An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. |
CVE-2023-42542 | Low | 3.3 | 2023-11-07 | Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device. |
CVE-2023-42540 | Medium | 4.0 | 2023-11-07 | Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent. |
CVE-2023-5976 | Medium | 4.3 | 2023-11-07 | Improper Access Control in GitHub repository microweber/microweber prior to 2.0. |
CVE-2018-25093 | Medium | 5.5 | 2023-11-06 | A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2018-25092 | Medium | 5.5 | 2023-11-05 | A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2023-36620 | Medium | 4.6 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in… |
CVE-2023-31020 | Medium | 6.1 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control… |
CVE-2023-31019 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restri… |
CVE-2023-43336 | High | 8.8 | 2023-11-02 | Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value… |
CVE-2023-5916 | Medium | 4.3 | 2023-11-02 | A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Co… |
CVE-2023-20267 | Medium | 4.0 | 2023-11-01 | A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vuln… |
CVE-2023-5833 | High | 8.8 | 2023-10-30 | Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. |
CVE-2018-17559 | High | 7.5 | 2023-10-26 | Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras. |
CVE-2023-46665 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain u… |
CVE-2023-46664 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-… |
CVE-2023-46663 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allo… |
CVE-2023-46662 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker… |
CVE-2023-46661 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests. |
CVE-2023-46666 | Medium | 5.3 | 2023-10-26 | An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user… |
CVE-2023-45228 | Medium | 6.5 | 2023-10-26 | The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by s… |
CVE-2023-42769 | Critical | 9.8 | 2023-10-26 | The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass auth… |
CVE-2023-30969 | High | 8.2 | 2023-10-26 | The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpo… |
CVE-2023-38848 | High | 7.5 | 2023-10-25 | An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-45844 | Medium | 6.8 | 2023-10-25 | The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverag… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-41721 | Medium | 5.3 | 2023-10-25 | Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with… |
CVE-2023-39731 | Medium | 5.3 | 2023-10-20 | The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-46033 | Medium | 6.8 | 2023-10-19 | D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U N150 ADSL2+ are vulnerable to Incorrect Access Control. The UART/Serial interface on the PCB, prov… |
CVE-2023-20261 | Medium | 6.5 | 2023-10-18 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected syste… |
CVE-2023-22102 | High | 8.3 | 2023-10-17 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to… |
CVE-2023-43814 | Low | 3.7 | 2023-10-16 | Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` e… |
CVE-2023-43119 | Critical | 9.8 | 2023-10-16 | An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated priv… |
CVE-2023-5240 | High | 7.5 | 2023-10-13 | Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scrip… |
CVE-2023-43079 | High | 7.3 | 2023-10-13 | Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user co… |
CVE-2023-41882 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collabo… |
CVE-2023-32632 | High | 8.8 | 2023-10-11 | A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can… |
CVE-2023-24479 | Critical | 9.8 | 2023-10-11 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead t… |
CVE-2023-44118 | Critical | 9.1 | 2023-10-11 | Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2023-41772 | High | 7.8 | 2023-10-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2023-36790 | High | 7.8 | 2023-10-10 | Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability |
CVE-2023-36725 | High | 7.8 | 2023-10-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-36722 | Medium | 4.4 | 2023-10-10 | Active Directory Domain Services Information Disclosure Vulnerability |
CVE-2023-36561 | High | 7.3 | 2023-10-10 | Azure DevOps Server Elevation of Privilege Vulnerability |
CVE-2023-41679 | High | 8.5 | 2023-10-10 | An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all… |
CVE-2023-33301 | Medium | 6.5 | 2023-10-10 | An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. |
CVE-2023-37194 | Medium | 6.7 | 2023-10-10 | A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All ver… |
CVE-2023-5365 | Critical | 9.8 | 2023-10-09 | HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure. |
CVE-2023-36820 | Medium | 4.8 | 2023-10-09 | Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1… |
CVE-2023-43696 | High | 8.2 | 2023-10-09 | Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP serve… |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-43072 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker c… |
CVE-2023-1832 | Medium | 6.8 | 2023-10-04 | An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confident… |
CVE-2023-22618 | High | 8.1 | 2023-10-04 | If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manip… |
CVE-2023-0506 | High | 8.8 | 2023-10-03 | The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera… |
CVE-2023-5353 | Medium | 6.5 | 2023-10-03 | Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-24844 | High | 8.4 | 2023-10-03 | Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range. |
CVE-2023-21673 | High | 8.7 | 2023-10-03 | Improper Access to the VM resource manager can lead to Memory Corruption. |
CVE-2023-32572 | Medium | 6.5 | 2023-10-03 | A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup Safe… |
CVE-2023-28372 | Medium | 6.5 | 2023-10-02 | A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the… |
CVE-2023-5288 | Critical | 9.8 | 2023-09-29 | A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM an… |
CVE-2023-32477 | High | 7.8 | 2023-09-29 | Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-privileged malicious user may potential… |
CVE-2023-20223 | High | 8.6 | 2023-09-27 | A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a repository that belongs to an internal service… |
CVE-2023-32458 | High | 7.3 | 2023-09-27 | Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerability in Embedded Service Enabler compo… |
CVE-2023-41322 | Medium | 4.9 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-41311 | Medium | 5.3 | 2023-09-27 | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to be activated automatically. |
CVE-2023-39376 | Medium | 6.5 | 2023-09-27 | SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network |
CVE-2023-43141 | Critical | 9.8 | 2023-09-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. |
CVE-2023-25525 | High | 7.5 | 2023-09-20 | NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DIPv6 set to the link… |
CVE-2022-47558 | Critical | 9.4 | 2023-09-19 | Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker… |
CVE-2023-38206 | Medium | 5.3 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2023-38205 | High | 7.5 | 2023-09-14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2023-40850 | High | 7.5 | 2023-09-13 | netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. There is a file leak in the website source code of the application security gateway. |
CVE-2023-20191 | Medium | 5.8 | 2023-09-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2023-36638 | Medium | 4.3 | 2023-09-13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0… |
CVE-2023-34470 | Medium | 6.8 | 2023-09-12 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerabi… |