CWE-284 · Improper Access Control (page 48)
Page 48 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35276 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enabl… |
CVE-2022-43679 | Medium | 4.2 | 2022-11-10 | The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof th… |
CVE-2022-39889 | Medium | 4.0 | 2022-11-09 | Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allows attackers to access wearable device in… |
CVE-2022-39887 | Medium | 4.3 | 2022-11-09 | Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting. |
CVE-2022-39884 | Medium | 4.3 | 2022-11-09 | Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to Call information. |
CVE-2022-31687 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be… |
CVE-2022-27673 | High | 7.5 | 2022-11-09 | Insufficient access controls in the AMD Link Android app may potentially result in information disclosure. |
CVE-2021-46851 | Critical | 9.8 | 2022-11-09 | The DRM module has a vulnerability in verifying the secure memory attributes. Successful exploitation of this vulnerability may cause abnormal video playback. |
CVE-2021-26360 | High | 7.8 | 2022-11-09 | An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential… |
CVE-2022-25932 | Critical | 9.8 | 2022-11-09 | The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still p… |
CVE-2022-42707 | High | 7.5 | 2022-11-06 | In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permi… |
CVE-2022-22442 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper ac… |
CVE-2022-39370 | Medium | 4.3 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-42814 | Medium | 5.5 | 2022-11-01 | A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-42811 | Medium | 5.5 | 2022-11-01 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An… |
CVE-2022-32946 | Medium | 5.5 | 2022-11-01 | This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to record audio using a pair of connecte… |
CVE-2022-32918 | Medium | 5.5 | 2022-11-01 | This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to bypass Privacy preferences. |
CVE-2022-32904 | Medium | 5.5 | 2022-11-01 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app ma… |
CVE-2022-3780 | High | 7.5 | 2022-11-01 | Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access… |
CVE-2022-42327 | High | 7.1 | 2022-11-01 | x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global share… |
CVE-2022-39329 | Low | 3.5 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2022-33757 | Medium | 6.5 | 2022-10-25 | An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the dis… |
CVE-2022-27805 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially… |
CVE-2021-44776 | Medium | 6.5 | 2022-10-24 | A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access right… |
CVE-2021-44467 | Medium | 5.3 | 2022-10-24 | A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other u… |
CVE-2021-26733 | Medium | 5.3 | 2022-10-24 | A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the… |
CVE-2021-26732 | Medium | 6.5 | 2022-10-24 | A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration… |
CVE-2022-26423 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1066 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-23241 | High | 8.1 | 2022-10-19 | Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allow an authenticated… |
CVE-2022-43429 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-40798 | High | 7.5 | 2022-10-19 | OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its… |
CVE-2022-39421 | High | 7.3 | 2022-10-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily… |
CVE-2022-39406 | High | 8.1 | 2022-10-18 | Vulnerability in the PeopleSoft Enterprise Common Components product of Oracle PeopleSoft (component: Approval Framework). The supported version that is affect… |
CVE-2022-39405 | Medium | 5.3 | 2022-10-18 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 12… |
CVE-2022-39399 | Low | 3.7 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected… |
CVE-2022-21619 | Low | 3.7 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected ar… |
CVE-2020-8973 | Critical | 9.3 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with acc… |
CVE-2022-38743 | High | 8.8 | 2022-10-17 | Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk V… |
CVE-2022-3382 | High | 7.5 | 2022-10-17 | HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, an attacker could craft code to disconnec… |
CVE-2022-3325 | Low | 2.7 | 2022-10-17 | Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all ver… |
CVE-2022-3286 | Medium | 5.3 | 2022-10-17 | Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member… |
CVE-2022-3067 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15… |
CVE-2022-3066 | Medium | 5.4 | 2022-10-17 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions sta… |
CVE-2022-3030 | Medium | 4.3 | 2022-10-17 | An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 be… |
CVE-2022-2630 | Medium | 4.3 | 2022-10-17 | An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosur… |
CVE-2022-2052 | Critical | 9.8 | 2022-10-17 | Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full acc… |
CVE-2022-39310 | Medium | 4.9 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-35689 | Medium | 5.3 | 2022-10-14 | Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security… |
CVE-2022-28761 | Medium | 6.5 | 2022-10-14 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a me… |
CVE-2022-28760 | Medium | 6.5 | 2022-10-14 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could o… |
CVE-2022-28759 | High | 8.2 | 2022-10-14 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could o… |
CVE-2022-42717 | High | 7.8 | 2022-10-11 | An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configur… |
CVE-2021-36913 | High | 7.5 | 2022-10-11 | Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to… |
CVE-2022-34431 | Medium | 6.5 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker could potentially exploit this vulnerabil… |
CVE-2022-38388 | Medium | 5.5 | 2022-10-11 | IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control. IBM X-Force ID: 2… |
CVE-2022-39878 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadc… |
CVE-2022-39877 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and be… |
CVE-2022-39875 | Medium | 5.1 | 2022-10-07 | Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39871 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39870 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39869 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39868 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implic… |
CVE-2022-39867 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39866 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… |
CVE-2022-39865 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information vi… |
CVE-2022-39864 | Low | 3.3 | 2022-10-07 | Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via i… |
CVE-2022-39860 | Medium | 4.4 | 2022-10-07 | Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast. |
CVE-2022-39857 | High | 7.3 | 2022-10-07 | Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system… |
CVE-2022-39855 | Medium | 5.1 | 2022-10-07 | Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices. |
CVE-2022-39854 | Medium | 6.4 | 2022-10-07 | Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. |
CVE-2022-39851 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS… |
CVE-2022-39850 | Low | 3.3 | 2022-10-07 | Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-39849 | Low | 3.3 | 2022-10-07 | Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-20728 | Medium | 4.7 | 2022-09-30 | A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from th… |
CVE-2022-1959 | Medium | 6.6 | 2022-09-30 | AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did n… |
CVE-2022-36771 | Medium | 6.5 | 2022-09-28 | IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID… |
CVE-2022-39835 | Medium | 5.3 | 2022-09-27 | An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. Th… |
CVE-2022-3263 | High | 7.8 | 2022-09-23 | The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modi… |
CVE-2022-32848 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to capture a user’s scre… |
CVE-2022-32800 | Medium | 5.5 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may… |
CVE-2022-32789 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferences. |
CVE-2022-32783 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthorized access to Bluetooth. |
CVE-2022-32226 | Medium | 4.3 | 2022-09-23 | An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not typ… |
CVE-2022-35621 | Medium | 5.3 | 2022-09-21 | Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows r… |
CVE-2022-41235 | Medium | 5.3 | 2022-09-21 | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file s… |
CVE-2022-32883 | Medium | 5.5 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An ap… |
CVE-2022-32880 | Medium | 6.5 | 2022-09-20 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data. |
CVE-2022-32872 | Low | 2.4 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device… |
CVE-2022-0143 | Critical | 9.3 | 2022-09-19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to… |
CVE-2022-2995 | High | 7.1 | 2022-09-19 | Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an… |
CVE-2022-23768 | High | 8.8 | 2022-09-19 | This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks s… |
CVE-2022-28758 | High | 8.2 | 2022-09-16 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could o… |
CVE-2022-3182 | High | 7.0 | 2022-09-13 | Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the appl… |
CVE-2022-3027 | Medium | 5.7 | 2022-09-13 | The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name… |
CVE-2022-36385 | Medium | 6.8 | 2022-09-13 | A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device fu… |
CVE-2022-38466 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions… |
CVE-2022-36875 | Medium | 6.6 | 2022-09-09 | Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file withou… |
CVE-2022-36869 | Medium | 6.6 | 2022-09-09 | Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permissi… |