CWE-284 · Improper Access Control (page 50)
Page 50 of 64 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0541 | Critical | 9.8 | 2022-04-25 | The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install… |
CVE-2022-20732 | High | 7.8 | 2022-04-21 | A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access… |
CVE-2021-43986 | Medium | 6.0 | 2022-04-20 | The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original… |
CVE-2022-21476 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2021-26627 | High | 7.5 | 2022-04-19 | Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to se… |
CVE-2022-24841 | Medium | 6.5 | 2022-04-18 | fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization b… |
CVE-2011-1762 | Medium | 6.5 | 2022-04-18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user wi… |
CVE-2022-20716 | High | 7.8 | 2022-04-15 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to imp… |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2020-25160 | Medium | 6.8 | 2022-04-14 | Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attack… |
CVE-2021-40405 | Medium | 6.5 | 2022-04-14 | A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reque… |
CVE-2022-22190 | High | 7.4 | 2022-04-14 | An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a craft… |
CVE-2022-22183 | High | 7.5 | 2022-04-14 | An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a speci… |
CVE-2022-25755 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-25650 | Medium | 6.5 | 2022-04-12 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2021-42029 | High | 7.8 | 2022-04-12 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC S… |
CVE-2022-28778 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder with… |
CVE-2022-28777 | Medium | 4.3 | 2022-04-11 | Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permissio… |
CVE-2022-28775 | Medium | 5.1 | 2022-04-11 | Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission. |
CVE-2022-28542 | Medium | 6.8 | 2022-04-11 | Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Stor… |
CVE-2022-27838 | High | 7.7 | 2022-04-11 | Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege. |
CVE-2022-27836 | High | 8.4 | 2022-04-11 | Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers t… |
CVE-2022-27822 | Medium | 6.6 | 2022-04-11 | Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission. |
CVE-2022-26091 | Medium | 5.7 | 2022-04-11 | Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key… |
CVE-2022-25831 | Low | 2.0 | 2022-04-11 | Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions. |
CVE-2022-20762 | High | 7.8 | 2022-04-06 | A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could al… |
CVE-2021-36776 | High | 8.8 | 2022-04-04 | A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions… |
CVE-2021-36775 | High | 8.8 | 2022-04-04 | a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher… |
CVE-2022-0405 | Medium | 4.3 | 2022-04-03 | Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2021-28504 | High | 7.5 | 2022-04-01 | On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that… |
CVE-2022-24731 | Medium | 6.8 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-24730 | High | 7.7 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-25481 | High | 7.5 | 2022-03-21 | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters fr… |
CVE-2022-23730 | Critical | 9.8 | 2022-03-11 | The public API error causes for the attacker to be able to bypass API access control. |
CVE-2022-25824 | Medium | 4.0 | 2022-03-10 | Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fil… |
CVE-2022-24930 | Medium | 4.4 | 2022-03-10 | An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to rese… |
CVE-2021-42855 | High | 7.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a… |
CVE-2022-26317 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow executi… |
CVE-2022-26313 | Critical | 9.8 | 2022-03-08 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected prod… |
CVE-2022-24309 | Medium | 6.8 | 2022-03-08 | A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All version… |
CVE-2021-41543 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling… |
CVE-2021-46270 | Low | 2.7 | 2022-03-02 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insuf… |
CVE-2021-45074 | Medium | 4.3 | 2022-03-02 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, whi… |
CVE-2022-0824 | High | 8.8 | 2022-03-02 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. |
CVE-2021-24688 | Medium | 4.3 | 2022-02-28 | The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one wh… |
CVE-2021-3967 | High | 8.8 | 2022-02-26 | Improper Access Control in GitHub repository zulip/zulip prior to 4.10. |
CVE-2022-21706 | High | 7.2 | 2022-02-26 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control… |
CVE-2020-14504 | Medium | 5.3 | 2022-02-24 | The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafte… |
CVE-2022-0732 | High | 7.5 | 2022-02-24 | The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (I… |
CVE-2022-0731 | Medium | 6.5 | 2022-02-23 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-0727 | Medium | 5.4 | 2022-02-23 | Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-23981 | Medium | 4.3 | 2022-02-18 | The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4). |
CVE-2021-4201 | Critical | 9.6 | 2022-02-14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, i… |
CVE-2022-24924 | Low | 2.2 | 2022-02-11 | An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission. |
CVE-2022-24923 | Medium | 4.0 | 2022-02-11 | Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL an… |
CVE-2022-23997 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted application… |
CVE-2022-23996 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable b… |
CVE-2022-23995 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23994 | Low | 3.3 | 2022-02-11 | An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23433 | Medium | 4.3 | 2022-02-11 | Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(1… |
CVE-2020-13677 | High | 7.5 | 2022-02-11 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. S… |
CVE-2020-13676 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affe… |
CVE-2020-13675 | Critical | 9.8 | 2022-02-11 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an acces… |
CVE-2022-21825 | High | 7.8 | 2022-02-09 | An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perfo… |
CVE-2022-21816 | Medium | 5.5 | 2022-02-07 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hyper… |
CVE-2022-21813 | Medium | 6.1 | 2022-02-07 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow… |
CVE-2021-21965 | Critical | 9.3 | 2022-02-04 | A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted… |
CVE-2021-21964 | High | 7.4 | 2022-02-04 | A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network… |
CVE-2022-0273 | Medium | 6.5 | 2022-01-30 | Improper Access Control in Pypi calibreweb prior to 0.6.16. |
CVE-2021-40416 | High | 8.8 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get… |
CVE-2021-40415 | Medium | 6.5 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check… |
CVE-2021-40414 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAla… |
CVE-2021-40413 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradeP… |
CVE-2021-40404 | Medium | 6.5 | 2022-01-28 | An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reques… |
CVE-2022-0203 | Medium | 5.3 | 2022-01-26 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. |
CVE-2022-0270 | High | 8.8 | 2022-01-25 | Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups. |
CVE-2021-23233 | High | 7.3 | 2022-01-21 | Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacke… |
CVE-2021-4016 | Medium | 4.0 | 2022-01-21 | Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An… |
CVE-2022-21305 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are… |
CVE-2022-21291 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are… |
CVE-2021-34402 | Medium | 6.7 | 2022-01-18 | NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location… |
CVE-2021-34401 | High | 7.8 | 2022-01-18 | NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execu… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2021-28507 | Medium | 5.5 | 2022-01-14 | An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF mig… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2022-0170 | Medium | 4.3 | 2022-01-11 | peertube is vulnerable to Improper Access Control |
CVE-2021-45034 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2022-0133 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Improper Access Control |
CVE-2021-23173 | Low | 2.6 | 2022-01-10 | The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data. |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-22567 | Medium | 4.6 | 2022-01-05 | Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a cod… |
CVE-2021-25991 | Medium | 5.7 | 2021-12-29 | In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deac… |
CVE-2021-20050 | High | 7.5 | 2021-12-23 | An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially e… |
CVE-2021-42808 | Medium | 6.5 | 2021-12-20 | Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. |
CVE-2021-4119 | Critical | 9.8 | 2021-12-15 | bookstack is vulnerable to Improper Access Control |
CVE-2021-36888 | Critical | 9.8 | 2021-12-15 | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPr… |
CVE-2021-24859 | Medium | 4.3 | 2021-12-13 | The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metada… |
CVE-2021-24845 | Medium | 6.5 | 2021-12-13 | The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary… |
CVE-2021-4089 | Medium | 4.3 | 2021-12-10 | snipe-it is vulnerable to Improper Access Control |