CWE-284 · Improper Access Control (page 49)
Page 49 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31484 | | 2025-04-02 | conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-… | |
CVE-2025-31726 | Medium | 5.5 | 2025-04-02 | Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2025-31725 | Medium | 5.5 | 2025-04-02 | Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Ext… |
CVE-2025-3082 | Low | 3.1 | 2025-04-01 | A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. T… |
CVE-2025-3042 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /studen… |
CVE-2025-3041 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/update… |
CVE-2025-3040 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-31187 | Medium | 5.5 | 2025-03-31 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be a… |
CVE-2025-30462 | Critical | 9.8 | 2025-03-31 | A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. App… |
CVE-2025-30460 | High | 7.4 | 2025-03-31 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, mac… |
CVE-2025-30450 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may… |
CVE-2025-30438 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ven… |
CVE-2025-30433 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14… |
CVE-2025-30425 | Medium | 4.3 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tv… |
CVE-2025-24272 | Medium | 6.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modif… |
CVE-2025-24259 | Critical | 9.8 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7… |
CVE-2025-24248 | Medium | 5.0 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have si… |
CVE-2025-24241 | Critical | 9.8 | 2025-03-31 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app… |
CVE-2025-24236 | Medium | 5.5 | 2025-03-31 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to acces… |
CVE-2025-24229 | High | 7.4 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A sandboxed app may be… |
CVE-2025-24218 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. An app may be able to access inf… |
CVE-2025-24215 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious… |
CVE-2025-24214 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS… |
CVE-2025-24205 | Medium | 5.5 | 2025-03-31 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24202 | Medium | 5.5 | 2025-03-31 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access s… |
CVE-2025-24198 | Medium | 6.6 | 2025-03-31 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4… |
CVE-2025-24193 | Low | 2.4 | 2025-03-31 | This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked devi… |
CVE-2025-24173 | High | 7.8 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2024-54533 | High | 7.0 | 2025-03-31 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A… |
CVE-2025-31125 | Medium | 5.3 | 2025-03-31 | Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposi… |
CVE-2025-22940 | Critical | 9.1 | 2025-03-31 | Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password. |
CVE-2025-2996 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /goform/SysToolDDNS… |
CVE-2025-2995 | Medium | 5.3 | 2025-03-31 | A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolCha… |
CVE-2025-2994 | Medium | 5.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects an unknown part of the file /goform/qossetting of the… |
CVE-2025-2993 | Medium | 5.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2992 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is an unknown functionality of the file /goform/… |
CVE-2025-2991 | Medium | 5.3 | 2025-03-31 | A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is an unknown function of the file /goform/AdvSetWrlmacfilter of… |
CVE-2025-2990 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/AdvSetWr… |
CVE-2025-2989 | Medium | 5.3 | 2025-03-31 | A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/AdvSetWr… |
CVE-2025-2978 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/u… |
CVE-2025-2973 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/st… |
CVE-2025-2955 | Medium | 5.3 | 2025-03-30 | A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/… |
CVE-2025-2954 | Low | 3.3 | 2025-03-30 | A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/to… |
CVE-2025-2952 | Medium | 6.3 | 2025-03-30 | A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.ph… |
CVE-2025-20230 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-20229 | High | 8.0 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.2… |
CVE-2025-26010 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword. |
CVE-2024-55963 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a serv… |
CVE-2025-2499 | Medium | 5.4 | 2025-03-26 | Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to… |
CVE-2025-23203 | Medium | 5.5 | 2025-03-26 | Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on severa… |
CVE-2023-52972 | Medium | 5.5 | 2025-03-26 | Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to ter… |
CVE-2025-29315 | Critical | 9.8 | 2025-03-24 | An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allo… |
CVE-2025-2706 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/Uplo… |
CVE-2025-30208 | Medium | 5.3 | 2025-03-24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to fil… |
CVE-2025-2705 | High | 7.3 | 2025-03-24 | A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. Th… |
CVE-2025-2702 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The… |
CVE-2025-2688 | Medium | 4.3 | 2025-03-24 | A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-2687 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the co… |
CVE-2025-2686 | Medium | 6.5 | 2025-03-24 | A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. Affected… |
CVE-2025-2671 | Medium | 6.3 | 2025-03-23 | A vulnerability was found in Yue Lao Blind Box 月老盲盒 up to 4.0. It has been declared as critical. This vulnerability affects the function base64image of the fil… |
CVE-2025-2607 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-2606 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-53348 | High | 7.4 | 2025-03-21 | LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges. |
CVE-2025-2557 | Medium | 5.5 | 2025-03-20 | A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-2553 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /g… |
CVE-2025-2552 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /g… |
CVE-2025-2551 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/for… |
CVE-2025-2550 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-2549 | Medium | 4.3 | 2025-03-20 | A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-2548 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/f… |
CVE-2025-2547 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of th… |
CVE-2025-2546 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formA… |
CVE-2024-11045 | Critical | 9.6 | 2025-03-20 | A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server ex… |
CVE-2025-30140 | High | 7.5 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name… |
CVE-2025-30141 | High | 7.5 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream. It exposes API endpoints on ports 9091… |
CVE-2025-30138 | Medium | 4.6 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unautho… |
CVE-2025-26138 | Medium | 6.5 | 2025-03-18 | Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible vi… |
CVE-2025-30132 | Critical | 9.1 | 2025-03-18 | An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis… |
CVE-2025-25585 | High | 7.3 | 2025-03-18 | Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Admin… |
CVE-2024-44313 | High | 8.1 | 2025-03-18 | TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and… |
CVE-2025-25500 | High | 7.5 | 2025-03-18 | An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. T… |
CVE-2023-47539 | Critical | 9.8 | 2025-03-18 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauth… |
CVE-2024-54565 | Medium | 6.2 | 2025-03-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data. |
CVE-2024-54559 | Medium | 5.5 | 2025-03-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data. |
CVE-2025-25621 | Medium | 4.3 | 2025-03-17 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses… |
CVE-2025-25618 | Low | 3.3 | 2025-03-17 | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers. |
CVE-2021-32584 | Medium | 5.3 | 2025-03-17 | An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, versio… |
CVE-2021-22126 | Medium | 6.7 | 2025-03-17 | A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may all… |
CVE-2025-2350 | Medium | 6.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2348 | Medium | 4.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an unknown function of the file /mnt/extsd/e… |
CVE-2025-2334 | Medium | 5.4 | 2025-03-15 | A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/… |
CVE-2025-25225 | Medium | 6.5 | 2025-03-15 | A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their… |
CVE-2025-25598 | High | 8.8 | 2025-03-13 | Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a c… |
CVE-2025-2280 | High | 8.1 | 2025-03-13 | Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser… |
CVE-2025-2278 | Medium | 6.5 | 2025-03-13 | Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user t… |
CVE-2025-25683 | Medium | 5.6 | 2025-03-12 | AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3… |
CVE-2025-20144 | Medium | 4.0 | 2025-03-12 | A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to… |
CVE-2024-13430 | Medium | 4.3 | 2025-03-12 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2025-2219 | High | 7.3 | 2025-03-12 | A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/i… |
CVE-2025-2218 | Medium | 5.3 | 2025-03-12 | A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system… |