CWE-284 · Improper Access Control (page 50)
Page 50 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2216 | Medium | 6.3 | 2025-03-12 | A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function… |
CVE-2025-23243 | Medium | 6.5 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data t… |
CVE-2025-23242 | High | 7.3 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escala… |
CVE-2025-26645 | High | 8.8 | 2025-03-11 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-24994 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24076 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2024-9157 | High | 7.8 | 2025-03-11 | ** UNSUPPORTED WHEN ASSIGNED ** A privilege escalation vulnerability in CxUIUSvc64.exe and CxUIUSvc32.exe of Synaptics audio drivers allows a local authorize… |
CVE-2025-25614 | High | 8.8 | 2025-03-10 | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers. |
CVE-2025-25616 | Medium | 4.3 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam… |
CVE-2025-25615 | Low | 2.7 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections. |
CVE-2025-2121 | Medium | 6.3 | 2025-03-09 | A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File S… |
CVE-2025-2115 | Medium | 6.3 | 2025-03-09 | A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of t… |
CVE-2025-25617 | Medium | 4.3 | 2025-03-07 | Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus. |
CVE-2025-2090 | Medium | 4.7 | 2025-03-07 | A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-2089 | Medium | 5.4 | 2025-03-07 | A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of t… |
CVE-2024-13635 | Medium | 4.3 | 2025-03-07 | The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. T… |
CVE-2025-25381 | High | 7.5 | 2025-03-06 | Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames an… |
CVE-2025-2035 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2031 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. Th… |
CVE-2024-56196 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended t… |
CVE-2024-56195 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3… |
CVE-2025-27649 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-2023-016. |
CVE-2025-27646 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001. |
CVE-2025-1260 | Critical | 9.1 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unex… |
CVE-2025-1259 | High | 7.7 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in user… |
CVE-2020-3122 | Medium | 5.3 | 2025-03-04 | A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, re… |
CVE-2025-1941 | Critical | 9.1 | 2025-03-04 | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245… |
CVE-2025-1890 | Medium | 6.3 | 2025-03-04 | A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/co… |
CVE-2025-1882 | Medium | 5.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the com… |
CVE-2025-1881 | Medium | 4.3 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-51954 | High | 8.5 | 2025-03-03 | There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote… |
CVE-2025-25950 | High | 8.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al… |
CVE-2025-25948 | Critical | 9.1 | 2025-03-03 | Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al… |
CVE-2025-1835 | Medium | 6.3 | 2025-03-02 | A vulnerability has been found in osuuu LightPicture 1.2.2 and classified as critical. This vulnerability affects the function upload of the file /app/controll… |
CVE-2025-1834 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of… |
CVE-2025-1818 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/ja… |
CVE-2025-1791 | Medium | 6.3 | 2025-03-01 | A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaij… |
CVE-2024-37567 | Critical | 9.1 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. |
CVE-2024-37566 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. |
CVE-2025-25730 | Medium | 4.6 | 2025-02-27 | An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthorized attackers to acc… |
CVE-2024-38291 | High | 8.8 | 2025-02-27 | In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. |
CVE-2024-53573 | Critical | 9.8 | 2025-02-26 | Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative… |
CVE-2024-36259 | High | 7.5 | 2025-02-25 | Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information v… |
CVE-2024-12368 | High | 8.1 | 2025-02-25 | Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other us… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2025-1646 | High | 7.3 | 2025-02-25 | A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyM… |
CVE-2024-53542 | Medium | 6.5 | 2025-02-24 | Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to… |
CVE-2025-27140 | Critical | 9.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application… |
CVE-2025-1606 | Medium | 4.3 | 2025-02-24 | A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2025-1598 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-1595 | Medium | 5.3 | 2025-02-23 | A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code… |
CVE-2025-1593 | Medium | 4.7 | 2025-02-23 | A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft… |
CVE-2025-1590 | Medium | 4.7 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modul… |
CVE-2025-1555 | High | 7.3 | 2025-02-21 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipu… |
CVE-2025-25968 | Medium | 6.0 | 2025-02-20 | DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, su… |
CVE-2025-21105 | Medium | 6.6 | 2025-02-20 | Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially ex… |
CVE-2024-13855 | Medium | 4.3 | 2025-02-20 | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_g… |
CVE-2025-24989 | High | 8.2 | 2025-02-19 | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user reg… |
CVE-2020-35546 | Critical | 9.1 | 2025-02-19 | Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings. |
CVE-2025-20153 | Medium | 5.8 | 2025-02-19 | A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules a… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2024-13854 | Medium | 4.3 | 2025-02-19 | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the na… |
CVE-2025-26617 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26616 | High | 7.5 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-26615 | Critical | 10.0 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-26613 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeG… |
CVE-2025-26611 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26609 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26608 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26607 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26606 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2024-56883 | High | 8.1 | 2025-02-18 | Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. L… |
CVE-2024-39327 | Critical | 9.9 | 2025-02-18 | Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way. |
CVE-2025-1390 | Medium | 6.1 | 2025-02-18 | The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incor… |
CVE-2025-1391 | Medium | 5.4 | 2025-02-17 | A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches th… |
CVE-2025-1355 | High | 7.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-34404 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a… |
CVE-2023-34403 | Medium | 4.9 | 2025-02-13 | Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A rac… |
CVE-2024-57378 | High | 7.3 | 2025-02-13 | Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning… |
CVE-2024-13229 | Medium | 4.3 | 2025-02-13 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on… |
CVE-2024-41934 | Medium | 5.9 | 2025-02-12 | Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2024-39797 | Medium | 6.5 | 2025-02-12 | Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticated user to potentially e… |
CVE-2024-38310 | High | 8.2 | 2025-02-12 | Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-37355 | High | 8.8 | 2025-02-12 | Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-36293 | Medium | 6.5 | 2025-02-12 | Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable… |
CVE-2024-30211 | Medium | 6.0 | 2025-02-12 | Improper access control in some Intel(R) ME driver pack installer engines before version 2422.6.2.0 may allow an authenticated user to potentially enable escal… |
CVE-2023-29164 | High | 7.3 | 2025-02-12 | Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02… |
CVE-2025-24435 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24429 | Low | 3.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24427 | Medium | 6.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24426 | Medium | 6.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24424 | Medium | 6.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24423 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24422 | Medium | 6.5 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24411 | High | 8.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could r… |
CVE-2025-24042 | High | 7.3 | 2025-02-11 | Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability |
CVE-2025-21359 | High | 7.8 | 2025-02-11 | Windows Kernel Security Feature Bypass Vulnerability |
CVE-2025-21337 | Low | 3.3 | 2025-02-11 | Windows NTFS Elevation of Privilege Vulnerability |
CVE-2024-40586 | Medium | 6.7 | 2025-02-11 | An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local us… |
CVE-2025-24532 | Medium | 4.3 | 2025-02-11 | A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V… |