CWE-284 · Improper Access Control (page 48)
Page 48 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-28231 | Critical | 9.1 | 2025-04-18 | Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges. |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2025-32795 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly gran… |
CVE-2025-28232 | Critical | 9.1 | 2025-04-18 | Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication. |
CVE-2025-28229 | Critical | 9.8 | 2025-04-18 | Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges. |
CVE-2025-3790 | Medium | 5.3 | 2025-04-18 | A vulnerability classified as critical has been found in baseweb JSite 1.0. This affects an unknown part of the file /druid/index.html of the component Apache… |
CVE-2025-32790 | Medium | 6.3 | 2025-04-18 | Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improper… |
CVE-2025-3783 | Medium | 6.3 | 2025-04-18 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unkno… |
CVE-2025-3765 | Medium | 6.3 | 2025-04-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3764 | Medium | 6.3 | 2025-04-17 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3113 | | 2025-04-17 | A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicatio… | |
CVE-2025-1568 | High | 8.8 | 2025-04-16 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to in… |
CVE-2024-53304 | Medium | 6.5 | 2025-04-16 | An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing a… |
CVE-2025-3675 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of t… |
CVE-2025-3674 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilt… |
CVE-2025-3668 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of… |
CVE-2025-3667 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-b… |
CVE-2025-3666 | Medium | 5.3 | 2025-04-16 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this issue is the function setDdnsCfg of the file /c… |
CVE-2025-3665 | Medium | 5.3 | 2025-04-16 | A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosC… |
CVE-2025-3664 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWiFiEasyGuestCfg of the file… |
CVE-2025-3663 | Medium | 5.3 | 2025-04-16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setW… |
CVE-2025-30100 | Medium | 6.7 | 2025-04-16 | Dell Alienware Command Center 6.x, versions prior to 6.7.37.0 contain an Improper Access Control Vulnerability. A low privileged attacker with local access cou… |
CVE-2025-30740 | Medium | 6.5 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30736 | High | 7.4 | 2025-04-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Difficult to… |
CVE-2025-30735 | High | 8.1 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration). The supporte… |
CVE-2025-30732 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30731 | Low | 3.6 | 2025-04-15 | Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected… |
CVE-2025-30729 | Medium | 5.5 | 2025-04-15 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-30728 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily… |
CVE-2025-30726 | Medium | 5.3 | 2025-04-15 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-1… |
CVE-2025-30714 | Medium | 4.8 | 2025-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0-9.2.0. Difficult t… |
CVE-2025-30713 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The supported version that i… |
CVE-2025-30711 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Supported versions that are affec… |
CVE-2025-30710 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDBCluster Plugin). Supported versions that are affected are 8.0.0-8.0.41, 8.4… |
CVE-2025-30709 | Medium | 6.1 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-30707 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.14. E… |
CVE-2025-30700 | Low | 3.5 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). The supported version that is affected is 11. Eas… |
CVE-2025-30699 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-… |
CVE-2025-30698 | Medium | 5.6 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |
CVE-2025-30697 | Medium | 5.4 | 2025-04-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2025-30696 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0… |
CVE-2025-30695 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30694 | Medium | 5.4 | 2025-04-15 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily… |
CVE-2025-30693 | Medium | 5.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30692 | Medium | 6.5 | 2025-04-15 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.7-12.2… |
CVE-2025-30691 | Medium | 4.8 | 2025-04-15 | Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and… |
CVE-2025-30690 | High | 7.2 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Difficult to exploit vul… |
CVE-2025-30689 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21588 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.4.0-8.4.4 and 9.0.0-9.2.0. Eas… |
CVE-2025-21587 | High | 7.4 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2025-21586 | Medium | 5.4 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-21573 | Medium | 6.0 | 2025-04-15 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supporte… |
CVE-2025-29705 | Medium | 4.3 | 2025-04-15 | code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects. |
CVE-2025-29984 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could pote… |
CVE-2025-31494 | Low | 3.5 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Pl… |
CVE-2025-3593 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of th… |
CVE-2025-3585 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser… |
CVE-2025-3566 | High | 7.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discu… |
CVE-2025-3565 | Medium | 4.7 | 2025-04-14 | A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uplo… |
CVE-2025-3558 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHead… |
CVE-2025-32726 | Medium | 6.8 | 2025-04-12 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2023-42969 | Low | 3.3 | 2025-04-11 | An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, mac… |
CVE-2025-23389 | High | 8.4 | 2025-04-11 | A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This is… |
CVE-2025-27191 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-27190 | Medium | 5.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-30288 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypas… |
CVE-2025-30281 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution… |
CVE-2025-29810 | High | 7.5 | 2025-04-08 | Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29804 | High | 7.3 | 2025-04-08 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-27744 | High | 7.8 | 2025-04-08 | Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2025-27738 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network. |
CVE-2025-26678 | High | 8.4 | 2025-04-08 | Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-21197 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permissi… |
CVE-2025-3410 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-pla… |
CVE-2025-3398 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/sr… |
CVE-2025-28413 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component |
CVE-2025-28412 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController |
CVE-2025-28411 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave |
CVE-2025-28410 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting us… |
CVE-2025-28409 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether… |
CVE-2025-28408 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not prope… |
CVE-2025-28407 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether… |
CVE-2025-28406 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter |
CVE-2025-28405 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method |
CVE-2025-28403 | High | 7.2 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has ad… |
CVE-2025-28402 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter |
CVE-2025-21425 | High | 7.3 | 2025-04-07 | Memory corruption may occur due top improper access control in HAB process. |
CVE-2025-3325 | Medium | 4.3 | 2025-04-06 | A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the com… |
CVE-2025-3324 | Medium | 6.3 | 2025-04-06 | A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality o… |
CVE-2025-3305 | Medium | 4.3 | 2025-04-05 | A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addIntercept… |
CVE-2025-3298 | Medium | 4.3 | 2025-04-05 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2025-3256 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/upd… |
CVE-2025-3255 | Medium | 4.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-3244 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-3237 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/wrlwpsse… |
CVE-2025-3236 | Medium | 5.3 | 2025-04-04 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/VirSerDM… |
CVE-2025-1865 | High | 7.8 | 2025-04-04 | The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows cr… |
CVE-2025-31486 | Medium | 5.3 | 2025-04-03 | Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with s… |
CVE-2025-3169 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/save… |
CVE-2025-3123 | Medium | 4.7 | 2025-04-02 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the c… |