CWE-284 · Improper Access Control (page 44)
Page 44 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34469 | Medium | 4.9 | 2023-09-12 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulner… |
CVE-2023-40730 | High | 7.1 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization… |
CVE-2023-3039 | High | 7.3 | 2023-09-12 | SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulne… |
CVE-2023-40039 | Critical | 9.8 | 2023-09-11 | An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value… |
CVE-2023-37759 | Critical | 9.8 | 2023-09-08 | Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin ac… |
CVE-2023-40060 | High | 7.2 | 2023-09-07 | A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication… |
CVE-2023-36635 | High | 7.1 | 2023-09-07 | An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to m… |
CVE-2021-40699 | High | 7.4 | 2023-09-07 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permis… |
CVE-2021-36036 | High | 7.2 | 2023-09-06 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's… |
CVE-2023-31242 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series… |
CVE-2023-4696 | Critical | 9.8 | 2023-09-01 | Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4650 | Medium | 4.7 | 2023-08-31 | Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-4640 | Medium | 6.5 | 2023-08-30 | The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by not… |
CVE-2023-40170 | Medium | 4.6 | 2023-08-28 | jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file conten… |
CVE-2023-4546 | Low | 3.5 | 2023-08-26 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230816. It has been declared as problematic. Affected by this vulnerability is an un… |
CVE-2023-40579 | Medium | 6.5 | 2023-08-25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable… |
CVE-2023-40573 | Critical | 9.0 | 2023-08-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scri… |
CVE-2022-3746 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to ca… |
CVE-2023-20230 | Medium | 5.4 | 2023-08-23 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2023-38132 | High | 8.8 | 2023-08-18 | LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allows an unauthenticated attacker to log in… |
CVE-2023-39973 | Medium | 4.3 | 2023-08-17 | Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns. |
CVE-2023-39972 | Medium | 4.3 | 2023-08-17 | Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists. |
CVE-2023-36106 | High | 7.5 | 2023-08-17 | An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying… |
CVE-2023-39743 | Medium | 5.3 | 2023-08-17 | lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c. |
CVE-2023-20237 | Medium | 4.3 | 2023-08-16 | A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise ina… |
CVE-2023-20224 | High | 7.8 | 2023-08-16 | A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate… |
CVE-2023-32609 | Medium | 5.0 | 2023-08-11 | Improper access control in the Intel Unite(R) android application before version 4.2.3504 may allow an authenticated user to potentially enable information dis… |
CVE-2023-32285 | Medium | 6.0 | 2023-08-11 | Improper access control in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-28714 | High | 8.2 | 2023-08-11 | Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user… |
CVE-2023-27509 | Medium | 6.6 | 2023-08-11 | Improper access control in some Intel(R) ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-27391 | Medium | 6.7 | 2023-08-11 | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially e… |
CVE-2023-25775 | Medium | 5.6 | 2023-08-11 | Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable… |
CVE-2023-25773 | High | 7.5 | 2023-08-11 | Improper access control in the Intel(R) Unite(R) Hub software installer for Windows before version 4.2.34962 may allow an authenticated user to potentially ena… |
CVE-2023-25757 | High | 7.3 | 2023-08-11 | Improper access control in some Intel(R) Unison(TM) software before version 10.12 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2023-23908 | Medium | 6.0 | 2023-08-11 | Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure vi… |
CVE-2022-45112 | High | 7.3 | 2023-08-11 | Improper access control in some Intel(R) VROC software before version 8.0.0.4035 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2022-40964 | High | 7.9 | 2023-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of pri… |
CVE-2022-38973 | Low | 3.3 | 2023-08-11 | Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an a… |
CVE-2022-37343 | High | 7.2 | 2023-08-11 | Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local a… |
CVE-2022-29871 | Medium | 6.7 | 2023-08-11 | Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2022-27635 | High | 8.2 | 2023-08-11 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of pri… |
CVE-2023-35179 | High | 7.2 | 2023-08-11 | A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must ha… |
CVE-2023-39963 | High | 8.1 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22… |
CVE-2023-39962 | High | 7.7 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 2… |
CVE-2023-39961 | Low | 3.5 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0… |
CVE-2023-39959 | Low | 3.5 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0… |
CVE-2023-39952 | Medium | 6.5 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24… |
CVE-2023-38167 | High | 7.2 | 2023-08-08 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2023-36890 | Medium | 6.5 | 2023-08-08 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2023-36889 | Medium | 5.5 | 2023-08-08 | Windows Group Policy Security Feature Bypass Vulnerability |
CVE-2023-39349 | High | 8.1 | 2023-08-07 | Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token wit… |
CVE-2023-4183 | Medium | 4.3 | 2023-08-06 | A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2023-4169 | Medium | 6.3 | 2023-08-05 | A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-34453 | High | 7.6 | 2023-08-03 | Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only user could potentially exploit this vulner… |
CVE-2023-37478 | High | 7.5 | 2023-08-01 | pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is… |
CVE-2022-43702 | High | 7.8 | 2023-07-27 | When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execu… |
CVE-2023-3786 | Medium | 4.3 | 2023-07-20 | A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulat… |
CVE-2023-22014 | High | 8.4 | 2023-07-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8… |
CVE-2023-37267 | High | 7.5 | 2023-07-13 | Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was pat… |
CVE-2023-29298 | High | 7.5 | 2023-07-12 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerabilit… |
CVE-2023-33155 | High | 7.8 | 2023-07-11 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2023-29130 | Critical | 9.9 | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files t… |
CVE-2023-24490 | Medium | 6.3 | 2023-07-10 | Users with only access to launch VDA applications can launch an unauthorized desktop |
CVE-2023-24489 | Critical | 9.8 | 2023-07-10 | A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to… |
CVE-2023-24486 | Medium | 5.5 | 2023-07-10 | A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the… |
CVE-2023-3273 | High | 7.5 | 2023-07-10 | Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of th… |
CVE-2023-3271 | High | 8.2 | 2023-07-10 | Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the RE… |
CVE-2023-35940 | High | 7.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an u… |
CVE-2023-35939 | High | 8.1 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file access… |
CVE-2023-34107 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a o… |
CVE-2023-34106 | Medium | 6.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on… |
CVE-2023-21518 | Medium | 4.4 | 2023-06-28 | Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity. |
CVE-2023-3431 | Medium | 5.3 | 2023-06-27 | Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9. |
CVE-2023-35927 | High | 7.6 | 2023-06-23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 u… |
CVE-2023-35173 | Medium | 5.7 | 2023-06-23 | Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data fi… |
CVE-2023-35167 | Medium | 5.0 | 2023-06-23 | Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns… |
CVE-2023-3304 | Medium | 5.4 | 2023-06-23 | Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-3303 | Low | 3.5 | 2023-06-23 | Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-1862 | High | 7.3 | 2023-06-20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access con… |
CVE-2023-3306 | High | 7.3 | 2023-06-18 | A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df… |
CVE-2023-3305 | High | 7.3 | 2023-06-18 | A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin… |
CVE-2023-28810 | Medium | 4.3 | 2023-06-15 | Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network confi… |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-32009 | High | 8.8 | 2023-06-14 | Windows Collaborative Translation Framework Elevation of Privilege Vulnerability |
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2022-39946 | High | 7.6 | 2023-06-13 | An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8… |
CVE-2023-2159 | Medium | 5.3 | 2023-06-09 | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass… |
CVE-2021-4380 | Critical | 9.8 | 2023-06-07 | The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_reques… |
CVE-2021-4364 | Medium | 4.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedul… |
CVE-2021-4361 | High | 8.8 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_setti… |
CVE-2021-4360 | Critical | 9.9 | 2023-06-07 | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting acce… |
CVE-2021-4352 | Medium | 5.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in ver… |
CVE-2021-4338 | Medium | 6.4 | 2023-06-07 | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in ve… |
CVE-2020-36721 | Medium | 6.5 | 2023-06-07 | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the… |
CVE-2020-36700 | High | 8.8 | 2023-06-07 | The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security no… |
CVE-2020-36699 | Medium | 4.3 | 2023-06-07 | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax a… |
CVE-2023-2183 | Medium | 4.1 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having… |
CVE-2023-21670 | High | 7.8 | 2023-06-06 | Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode. |
CVE-2022-40529 | High | 7.1 | 2023-06-06 | Memory corruption due to improper access control in kernel while processing a mapping request from root process. |
CVE-2023-3099 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the li… |