CWE-284 · Improper Access Control (page 49)
Page 49 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36867 | Medium | 5.9 | 2022-09-09 | Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. |
CVE-2022-36866 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows… |
CVE-2022-36865 | Medium | 4.0 | 2022-09-09 | Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device i… |
CVE-2022-36864 | Medium | 4.0 | 2022-09-09 | Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged beh… |
CVE-2022-36856 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-20696 | High | 7.5 | 2022-09-08 | A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to th… |
CVE-2022-36088 | Medium | 5.0 | 2022-09-07 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permi… |
CVE-2022-21950 | Medium | 5.3 | 2022-09-07 | A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hi… |
CVE-2022-3065 | High | 7.5 | 2022-09-02 | Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2021-3864 | High | 7.0 | 2022-08-26 | A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that s… |
CVE-2022-32834 | Medium | 5.5 | 2022-08-24 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Cata… |
CVE-2021-4037 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-syst… |
CVE-2022-2792 | Medium | 6.6 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with… |
CVE-2022-36263 | High | 7.3 | 2022-08-19 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. |
CVE-2022-36024 | High | 7.5 | 2022-08-18 | py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the… |
CVE-2022-34259 | Medium | 5.3 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-34255 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-38184 | High | 7.5 | 2022-08-16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access… |
CVE-2022-28754 | High | 7.1 | 2022-08-11 | Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can joi… |
CVE-2022-28753 | High | 7.1 | 2022-08-11 | Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can joi… |
CVE-2022-36923 | High | 7.5 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 t… |
CVE-2022-20358 | Low | 3.3 | 2022-08-10 | In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. T… |
CVE-2022-33931 | Medium | 6.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no access to Alert Classification page cou… |
CVE-2022-33926 | High | 7.1 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an improper access control vulnerability. A remote malicious user could exploit this vulnerability in order… |
CVE-2022-33925 | Medium | 6.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An remote authenticated attacker could potentially exploit… |
CVE-2022-33924 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker with no access to create rules could potent… |
CVE-2021-46304 | High | 7.5 | 2022-08-10 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-802… |
CVE-2022-2702 | High | 7.3 | 2022-08-08 | A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file si… |
CVE-2022-27660 | High | 7.5 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network pa… |
CVE-2022-27185 | High | 7.5 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_master_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network pa… |
CVE-2022-27178 | Critical | 9.8 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_wan_cfg functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packe… |
CVE-2022-26346 | Critical | 9.8 | 2022-08-05 | A denial of service vulnerability exists in the ucloud_del_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet ca… |
CVE-2021-28511 | Medium | 5.8 | 2022-08-05 | This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the sec… |
CVE-2022-36832 | Medium | 4.0 | 2022-08-05 | Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage… |
CVE-2022-33731 | Medium | 5.1 | 2022-08-05 | Improper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and disable arbitrary components. |
CVE-2022-33720 | Low | 2.4 | 2022-08-05 | Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortc… |
CVE-2022-33714 | Medium | 6.2 | 2022-08-05 | Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile… |
CVE-2020-1754 | Medium | 4.3 | 2022-08-05 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewi… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-26308 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could cre… |
CVE-2022-2578 | Medium | 6.3 | 2022-07-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of… |
CVE-2016-4427 | High | 7.5 | 2022-07-28 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. |
CVE-2016-4426 | Medium | 4.3 | 2022-07-28 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. |
CVE-2021-38417 | High | 7.4 | 2022-07-27 | VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to fo… |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2022-31475 | Medium | 5.5 | 2022-07-21 | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-21586 | Medium | 6.4 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |
CVE-2022-1025 | High | 8.8 | 2022-07-12 | All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate thei… |
CVE-2022-33706 | Low | 2.4 | 2022-07-12 | Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture. |
CVE-2022-33701 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSleep method which is… |
CVE-2022-30752 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap cli… |
CVE-2022-30751 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap cli… |
CVE-2022-30750 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wi… |
CVE-2022-31257 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2022-20859 | Medium | 6.5 | 2022-07-06 | A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence… |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-2088 | Medium | 6.8 | 2022-06-27 | An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0. |
CVE-2020-9754 | Medium | 5.3 | 2022-06-27 | NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. |
CVE-2022-2103 | Critical | 9.8 | 2022-06-24 | An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable… |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2017-20066 | Medium | 5.3 | 2022-06-20 | A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to imprope… |
CVE-2022-27511 | High | 8.1 | 2022-06-16 | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, a… |
CVE-2022-28612 | Medium | 5.4 | 2022-06-15 | Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in… |
CVE-2022-32158 | Critical | 9.0 | 2022-06-15 | Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the… |
CVE-2022-1958 | Medium | 6.3 | 2022-06-15 | A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to im… |
CVE-2022-32256 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-32255 | Medium | 5.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-31055 | High | 7.5 | 2022-06-13 | kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and al… |
CVE-2022-1659 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the i… |
CVE-2022-1658 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via t… |
CVE-2022-1656 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in li… |
CVE-2022-30745 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. |
CVE-2022-30715 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window. |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-1261 | Medium | 5.8 | 2022-05-26 | Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC se… |
CVE-2021-41834 | Medium | 5.3 | 2022-05-23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to r… |
CVE-2022-29160 | Low | 2.8 | 2022-05-20 | Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related… |
CVE-2020-4107 | High | 8.8 | 2022-05-19 | HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerabil… |
CVE-2021-45730 | Medium | 6.0 | 2022-05-19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Re… |
CVE-2022-28184 | High | 7.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileg… |
CVE-2021-35249 | Medium | 4.3 | 2022-05-17 | This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should no… |
CVE-2022-1753 | Medium | 5.4 | 2022-05-17 | A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The… |
CVE-2021-27444 | Critical | 9.8 | 2022-05-16 | The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sen… |
CVE-2022-1553 | Medium | 4.9 | 2022-05-16 | Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vul… |
CVE-2022-0574 | Medium | 6.5 | 2022-05-16 | Improper Access Control in GitHub repository publify/publify prior to 9.2.8. |
CVE-2022-22282 | Critical | 9.8 | 2022-05-13 | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthori… |
CVE-2021-33013 | High | 8.2 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information. |
CVE-2022-21182 | High | 8.8 | 2022-05-12 | A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP re… |
CVE-2022-26926 | High | 7.8 | 2022-05-10 | Windows Address Book Remote Code Execution Vulnerability |
CVE-2019-25060 | Medium | 5.3 | 2022-05-09 | The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a r… |
CVE-2022-1631 | High | 8.8 | 2022-05-09 | Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no… |
CVE-2022-20780 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-20779 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-20777 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-28780 | Medium | 5.0 | 2022-05-03 | Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that set in Weather with… |
CVE-2022-29417 | Medium | 4.3 | 2022-04-25 | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a sub… |