CWE-284 · Improper Access Control (page 46)
Page 46 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27578 | Critical | 9.1 | 2023-03-20 | Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insuffici… |
CVE-2023-1491 | Medium | 4.4 | 2023-03-18 | A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryp… |
CVE-2023-1490 | Medium | 4.4 | 2023-03-18 | A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDA… |
CVE-2023-1489 | High | 7.8 | 2023-03-18 | A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0… |
CVE-2023-1486 | Medium | 4.4 | 2023-03-18 | A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the… |
CVE-2023-1453 | Medium | 4.4 | 2023-03-17 | A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsd… |
CVE-2023-28531 | Critical | 9.8 | 2023-03-17 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. |
CVE-2023-21465 | Medium | 5.5 | 2023-03-16 | Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files. |
CVE-2023-21463 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.03.0 in Android 13 a… |
CVE-2023-21457 | Medium | 4.1 | 2023-03-16 | Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission. |
CVE-2023-0811 | Critical | 9.1 | 2023-03-16 | Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE… |
CVE-2023-27875 | High | 7.5 | 2023-03-16 | IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. |
CVE-2023-1432 | High | 7.3 | 2023-03-16 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-24468 | Critical | 9.8 | 2023-03-15 | Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2 |
CVE-2023-27268 | Medium | 5.3 | 2023-03-14 | SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attac… |
CVE-2023-26460 | Medium | 5.3 | 2023-03-14 | Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that requi… |
CVE-2022-2259 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
CVE-2023-23911 | High | 7.5 | 2023-03-10 | An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the grou… |
CVE-2022-40539 | High | 8.4 | 2023-03-10 | Memory corruption in Automotive Android OS due to improper validation of array index. |
CVE-2022-4331 | Medium | 5.7 | 2023-03-09 | An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions… |
CVE-2023-27088 | High | 8.8 | 2023-03-08 | feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within t… |
CVE-2023-25605 | High | 7.5 | 2023-03-07 | A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unautho… |
CVE-2023-22335 | High | 7.5 | 2023-03-06 | Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to bypass acc… |
CVE-2022-40633 | Medium | 4.6 | 2023-03-02 | A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks. |
CVE-2023-26474 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text a… |
CVE-2023-26473 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored… |
CVE-2023-26471 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted m… |
CVE-2022-23240 | Medium | 6.5 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorize… |
CVE-2023-23508 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be ab… |
CVE-2022-32902 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be abl… |
CVE-2023-25821 | Medium | 5.7 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access… |
CVE-2023-1007 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd… |
CVE-2023-0998 | Medium | 6.5 | 2023-02-24 | A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alpha… |
CVE-2023-0963 | High | 7.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users… |
CVE-2023-24320 | Critical | 9.8 | 2023-02-21 | An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors. |
CVE-2023-22920 | Critical | 9.8 | 2023-02-21 | A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended… |
CVE-2023-0916 | Medium | 6.3 | 2023-02-19 | A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-22232 | Medium | 5.3 | 2023-02-17 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feat… |
CVE-2023-23923 | High | 8.2 | 2023-02-17 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for a… |
CVE-2023-24485 | High | 7.8 | 2023-02-16 | Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace… |
CVE-2023-24484 | Medium | 5.5 | 2023-02-16 | A malicious user can cause log files to be written to a directory that they do not have permission to write to. |
CVE-2023-23752 | Medium | 5.3 | 2023-02-16 | An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. |
CVE-2022-38935 | High | 8.8 | 2023-02-15 | An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminCon… |
CVE-2023-22807 | Critical | 9.8 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could contro… |
CVE-2023-22805 | Medium | 6.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to re… |
CVE-2022-46892 | Critical | 9.8 | 2023-02-15 | In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex. |
CVE-2023-20927 | High | 7.8 | 2023-02-15 | In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation… |
CVE-2023-21777 | High | 8.7 | 2023-02-14 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2023-21717 | High | 8.8 | 2023-02-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-25149 | High | 8.8 | 2023-02-14 | TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleD… |
CVE-2023-23835 | Medium | 5.9 | 2023-02-14 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.2… |
CVE-2023-25161 | Low | 3.7 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2023-25159 | Low | 2.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the s… |
CVE-2023-0661 | Medium | 6.5 | 2023-02-12 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. |
CVE-2022-33243 | High | 8.4 | 2023-02-12 | Memory corruption due to improper access control in Qualcomm IPC. |
CVE-2022-46755 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for… |
CVE-2022-46754 | High | 8.7 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license fe… |
CVE-2022-46678 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy… |
CVE-2022-46677 | Medium | 6.8 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for… |
CVE-2022-46676 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disable or delete users under administration… |
CVE-2023-24688 | Medium | 5.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled. |
CVE-2023-21447 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privil… |
CVE-2023-21445 | Medium | 5.5 | 2023-02-09 | Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allo… |
CVE-2023-21442 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attack… |
CVE-2023-21438 | Low | 2.1 | 2023-02-09 | Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. |
CVE-2023-21427 | Medium | 5.4 | 2023-02-09 | Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. |
CVE-2022-30564 | Medium | 5.3 | 2023-02-09 | Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable… |
CVE-2022-47648 | High | 7.6 | 2023-02-08 | An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticati… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2023-0744 | Critical | 9.8 | 2023-02-08 | Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-23615 | Medium | 5.3 | 2023-02-03 | Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or conte… |
CVE-2022-47699 | Critical | 9.8 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control. |
CVE-2023-24425 | Medium | 6.5 | 2023-01-26 | Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing… |
CVE-2023-24022 | Critical | 10.0 | 2023-01-26 | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered a… |
CVE-2023-0451 | High | 7.5 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One… |
CVE-2022-40036 | Medium | 6.5 | 2023-01-26 | An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserLi… |
CVE-2022-31704 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an… |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2023-24058 | Medium | 4.3 | 2023-01-22 | Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2… |
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2020-22655 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-22339 | High | 7.5 | 2023-01-20 | Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction… |
CVE-2022-46890 | Medium | 4.3 | 2023-01-19 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by… |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2023-21860 | Medium | 6.3 | 2023-01-18 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported versions that are affected are 7.4.38 and prio… |
CVE-2023-21894 | High | 7.3 | 2023-01-18 | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Suppo… |
CVE-2023-21893 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to ex… |
CVE-2023-21857 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). Supported versions that are affected… |
CVE-2023-21855 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Supported versions that are aff… |
CVE-2023-21854 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported versions that are affected are 12.2.3-12… |
CVE-2023-21853 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Supported versions that are affected are 12… |
CVE-2023-21852 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Supported versions that are affected are 12.2.3-12.2.12… |
CVE-2023-21851 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2… |
CVE-2023-21850 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affecte… |
CVE-2023-21849 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2… |
CVE-2023-21846 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0… |
CVE-2023-21832 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0… |
CVE-2023-21828 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported versio… |
CVE-2022-46331 | High | 7.5 | 2023-01-18 | An unauthorized user could possibly delete any file on the system. |
CVE-2022-43494 | High | 7.5 | 2023-01-18 | An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. |