CWE-284 · Improper Access Control (page 51)
Page 51 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1166 | Medium | 6.3 | 2025-02-11 | A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-1165 | High | 7.3 | 2025-02-11 | A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ash… |
CVE-2024-46432 | High | 8.8 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setQuickCfgWifiAndLogi… |
CVE-2024-46430 | Medium | 6.5 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated rem… |
CVE-2025-1115 | Low | 3.3 | 2025-02-08 | A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_contro… |
CVE-2022-26389 | High | 7.7 | 2025-02-07 | An improper access control vulnerability may allow privilege escalation.This issue affects: * ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prio… |
CVE-2024-57249 | Medium | 6.5 | 2025-02-07 | Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerabil… |
CVE-2024-56889 | High | 7.5 | 2025-02-06 | Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete… |
CVE-2025-24968 | High | 8.8 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, suc… |
CVE-2024-13514 | Medium | 4.3 | 2025-02-04 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb… |
CVE-2024-35177 | High | 7.8 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-56898 | High | 8.8 | 2025-02-03 | Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that the… |
CVE-2023-52164 | Medium | 5.1 | 2025-02-03 | access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products that are no longer sup… |
CVE-2024-57433 | High | 7.5 | 2025-01-31 | macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches… |
CVE-2024-23920 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2025-24885 | High | 7.6 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custo… |
CVE-2025-23367 | Medium | 6.5 | 2025-01-30 | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role… |
CVE-2025-0745 | High | 7.5 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of… |
CVE-2025-0744 | High | 7.5 | 2025-01-30 | an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription p… |
CVE-2025-0743 | Medium | 5.3 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint… |
CVE-2025-0742 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by… |
CVE-2025-0741 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into… |
CVE-2025-0740 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages… |
CVE-2025-0739 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's in… |
CVE-2024-13457 | Medium | 5.3 | 2025-01-30 | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the… |
CVE-2025-0802 | High | 7.3 | 2025-01-29 | A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-0783 | Medium | 6.3 | 2025-01-28 | A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpo… |
CVE-2025-24365 | High | 8.1 | 2025-01-27 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organizatio… |
CVE-2025-0722 | Medium | 4.7 | 2025-01-27 | A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the… |
CVE-2025-0702 | Medium | 6.3 | 2025-01-24 | A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code… |
CVE-2025-0650 | High | 8.1 | 2025-01-23 | A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured… |
CVE-2025-23083 | High | 7.7 | 2025-01-22 | With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also… |
CVE-2024-57360 | Medium | 5.5 | 2025-01-21 | https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-… |
CVE-2025-0582 | Medium | 4.7 | 2025-01-20 | A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig… |
CVE-2025-21185 | Medium | 6.5 | 2025-01-17 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-57032 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is poss… |
CVE-2024-12370 | Medium | 5.3 | 2025-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all version… |
CVE-2024-55954 | High | 8.7 | 2025-01-16 | OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role u… |
CVE-2025-0481 | Medium | 5.3 | 2025-01-15 | A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP P… |
CVE-2025-21405 | High | 7.3 | 2025-01-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2025-21340 | Medium | 5.5 | 2025-01-14 | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability |
CVE-2025-21301 | Medium | 6.5 | 2025-01-14 | Windows Geolocation Service Information Disclosure Vulnerability |
CVE-2025-21293 | High | 8.8 | 2025-01-14 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2025-21213 | Medium | 4.6 | 2025-01-14 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2025-21202 | Medium | 6.1 | 2025-01-14 | Windows Recovery Environment Agent Elevation of Privilege Vulnerability |
CVE-2025-0463 | Medium | 6.3 | 2025-01-14 | A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown fu… |
CVE-2025-0460 | High | 7.3 | 2025-01-14 | A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.ph… |
CVE-2024-45326 | Medium | 4.3 | 2025-01-14 | An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all version… |
CVE-2025-0403 | Medium | 5.3 | 2025-01-13 | A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-0402 | Medium | 6.3 | 2025-01-13 | A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/… |
CVE-2025-0399 | Medium | 4.7 | 2025-01-12 | A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file… |
CVE-2025-21380 | High | 8.8 | 2025-01-09 | Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network. |
CVE-2024-13240 | High | 7.5 | 2025-01-09 | Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 befor… |
CVE-2025-0346 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/p… |
CVE-2025-0341 | Medium | 6.3 | 2025-01-09 | A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknow… |
CVE-2025-0335 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-13212 | Medium | 6.3 | 2025-01-09 | A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/hous… |
CVE-2024-13211 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/jav… |
CVE-2024-13210 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of… |
CVE-2024-13201 | Medium | 4.7 | 2025-01-09 | A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/mai… |
CVE-2024-13200 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/c… |
CVE-2024-13191 | Medium | 6.3 | 2025-01-08 | A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/w… |
CVE-2024-40749 | High | 7.5 | 2025-01-07 | Improper Access Controls allows access to protected views. |
CVE-2024-13145 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com… |
CVE-2024-13144 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/sit… |
CVE-2025-0227 | Medium | 4.3 | 2025-01-05 | A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part… |
CVE-2025-0226 | Medium | 4.3 | 2025-01-05 | A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue… |
CVE-2025-0224 | Medium | 5.3 | 2025-01-05 | A vulnerability was found in Provision-ISR SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U) and NVR5-8200PX up to 20241220. It ha… |
CVE-2024-13138 | Medium | 4.7 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/j… |
CVE-2024-13134 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/mai… |
CVE-2024-13133 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the… |
CVE-2025-0213 | Medium | 6.3 | 2025-01-04 | A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /fo… |
CVE-2025-0206 | Medium | 5.3 | 2025-01-04 | A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-13110 | Medium | 4.3 | 2025-01-02 | A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown… |
CVE-2024-13108 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /g… |
CVE-2024-13107 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/for… |
CVE-2024-13106 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-13105 | Medium | 5.3 | 2025-01-02 | A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-13104 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/f… |
CVE-2024-13103 | Medium | 5.3 | 2025-01-02 | A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of th… |
CVE-2024-13102 | Medium | 5.3 | 2025-01-02 | A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS… |
CVE-2024-25133 | High | 8.8 | 2024-12-31 | A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enab… |
CVE-2024-13067 | Medium | 5.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2024-13042 | Medium | 4.3 | 2024-12-30 | A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the… |
CVE-2024-13030 | High | 7.3 | 2024-12-30 | A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientI… |
CVE-2024-13022 | Medium | 6.3 | 2024-12-29 | A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com… |
CVE-2024-50945 | High | 7.5 | 2024-12-27 | An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without v… |
CVE-2024-12984 | Medium | 5.3 | 2024-12-27 | A vulnerability classified as problematic has been found in Amcrest IP2M-841B, IP2M-841W, IPC-IP2M-841B, IPC-IP3M-943B, IPC-IP3M-943S, IPC-IP3M-HX2B and IPC-IP… |
CVE-2024-12956 | Medium | 6.3 | 2024-12-26 | A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2024-12954 | Medium | 6.3 | 2024-12-26 | A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /up… |
CVE-2024-12953 | Medium | 6.3 | 2024-12-26 | A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected by this issue is some unknown… |
CVE-2024-12951 | Medium | 6.3 | 2024-12-26 | A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /add_pe… |
CVE-2024-12896 | Medium | 5.3 | 2024-12-22 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-56330 | | 2024-12-20 | Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow user… | |
CVE-2024-9503 | Medium | 4.3 | 2024-12-20 | The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-11358 | Medium | 5.7 | 2024-12-16 | Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file… |
CVE-2024-12478 | Medium | 6.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index… |
CVE-2024-24902 | Medium | 6.6 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local attacker could potentially exploit this… |
CVE-2024-54096 | Medium | 5.3 | 2024-12-12 | Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy. |