CWE-284 · Improper Access Control (page 52)
Page 52 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10124 | Critical | 9.8 | 2024-12-12 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation… |
CVE-2024-49107 | High | 7.3 | 2024-12-12 | WmsRepair Service Elevation of Privilege Vulnerability |
CVE-2024-49105 | High | 8.4 | 2024-12-12 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2024-49068 | High | 8.2 | 2024-12-12 | Microsoft SharePoint Elevation of Privilege Vulnerability |
CVE-2024-43600 | High | 7.8 | 2024-12-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2024-43594 | High | 7.3 | 2024-12-12 | Microsoft System Center Elevation of Privilege Vulnerability |
CVE-2024-48912 | High | 8.1 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application… |
CVE-2024-47760 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can tak… |
CVE-2024-47758 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take… |
CVE-2024-12294 | Medium | 5.3 | 2024-12-11 | The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'g… |
CVE-2024-43717 | Medium | 4.3 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A… |
CVE-2024-43716 | Medium | 4.3 | 2024-12-10 | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A… |
CVE-2024-54038 | Medium | 4.3 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-… |
CVE-2024-11868 | Medium | 5.3 | 2024-12-10 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via cl… |
CVE-2024-49600 | High | 7.8 | 2024-12-09 | Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potential… |
CVE-2024-12307 | Medium | 4.3 | 2024-12-09 | A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data… |
CVE-2024-12306 | Medium | 4.3 | 2024-12-09 | Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of s… |
CVE-2024-12235 | Medium | 6.3 | 2024-12-05 | A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerabil… |
CVE-2024-12233 | High | 7.3 | 2024-12-05 | A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2024-10937 | Medium | 5.3 | 2024-12-05 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information E… |
CVE-2024-20397 | Medium | 5.2 | 2024-12-04 | A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticat… |
CVE-2024-11961 | Medium | 5.3 | 2024-11-28 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of… |
CVE-2016-10408 | High | 8.4 | 2024-11-26 | QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable m… |
CVE-2024-11674 | Medium | 6.3 | 2024-11-26 | A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/… |
CVE-2024-11661 | Medium | 4.3 | 2024-11-25 | A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2024-11483 | Medium | 5.0 | 2024-11-25 | A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAut… |
CVE-2024-8805 | High | 8.8 | 2024-11-22 | BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitr… |
CVE-2023-51644 | High | 7.3 | 2024-11-22 | Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-10393 | Medium | 5.3 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the… |
CVE-2024-11484 | Medium | 6.3 | 2024-11-20 | A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-48899 | Medium | 4.3 | 2024-11-20 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended… |
CVE-2021-1410 | Medium | 4.3 | 2024-11-18 | A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that… |
CVE-2024-37155 | Medium | 6.5 | 2024-11-18 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the rege… |
CVE-2024-22067 | Medium | 6.8 | 2024-11-18 | ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker… |
CVE-2024-52514 | Medium | 4.1 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the us… |
CVE-2024-52509 | Low | 3.5 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without do… |
CVE-2024-50653 | High | 7.5 | 2024-11-15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packe… |
CVE-2021-34753 | Medium | 5.8 | 2024-11-15 | A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2024-20373 | Medium | 5.3 | 2024-11-15 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco I… |
CVE-2021-3987 | Medium | 4.3 | 2024-11-15 | An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public sh… |
CVE-2024-11214 | Medium | 4.7 | 2024-11-14 | A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11211 | Medium | 4.7 | 2024-11-14 | A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipu… |
CVE-2024-39609 | High | 7.5 | 2024-11-13 | Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation of privilege via lo… |
CVE-2024-39285 | Medium | 5.3 | 2024-11-13 | Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable information disclosure via loc… |
CVE-2024-36488 | High | 7.3 | 2024-11-13 | Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-34022 | Medium | 6.7 | 2024-11-13 | Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-32483 | High | 8.2 | 2024-11-13 | Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-32044 | Medium | 6.8 | 2024-11-13 | Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated user to potentially… |
CVE-2024-29085 | Medium | 5.5 | 2024-11-13 | Improper access control for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable escalation of… |
CVE-2024-29077 | Medium | 6.7 | 2024-11-13 | Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-27200 | Medium | 4.4 | 2024-11-13 | Improper access control in some Intel(R) Granulate(TM) software before version 4.30.1 may allow a authenticated user to potentially enable escalation of privil… |
CVE-2024-49049 | High | 7.1 | 2024-11-12 | Visual Studio Code Remote Extension Elevation of Privilege Vulnerability |
CVE-2024-49044 | Medium | 6.7 | 2024-11-12 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2024-43530 | High | 7.8 | 2024-11-12 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-11138 | Low | 2.7 | 2024-11-12 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. Th… |
CVE-2024-2315 | High | 7.1 | 2024-11-12 | APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to… |
CVE-2024-50558 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-11122 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functional… |
CVE-2024-11054 | Medium | 6.3 | 2024-11-10 | A vulnerability classified as critical was found in SourceCodester Simple Music Cloud Community System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-46948 | Medium | 4.3 | 2024-11-08 | Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. |
CVE-2024-11000 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10999 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd… |
CVE-2024-10994 | Medium | 6.3 | 2024-11-08 | A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-10993 | Medium | 6.3 | 2024-11-08 | A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /m… |
CVE-2024-48010 | Medium | 6.5 | 2024-11-08 | Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability. A remote high privileged attacke… |
CVE-2019-20462 | Medium | 5.3 | 2024-11-07 | An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device comes with a serial interface at the board level. By attaching to this serial interfac… |
CVE-2024-51995 | High | 7.1 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This… |
CVE-2024-10965 | Medium | 4.3 | 2024-11-07 | A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2… |
CVE-2024-51988 | Medium | 6.5 | 2024-11-06 | RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configur… |
CVE-2024-10916 | Medium | 5.3 | 2024-11-06 | A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the… |
CVE-2023-29121 | Critical | 9.6 | 2024-11-05 | Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system. |
CVE-2023-29115 | Medium | 6.5 | 2024-11-05 | In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot). |
CVE-2024-7429 | Medium | 4.3 | 2024-11-05 | The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX fu… |
CVE-2024-51734 | | 2024-11-04 | Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `Acces… | |
CVE-2024-10766 | Medium | 6.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown pro… |
CVE-2024-10765 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10764 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_… |
CVE-2024-7424 | Medium | 5.4 | 2024-11-01 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability chec… |
CVE-2024-50353 | Medium | 5.3 | 2024-10-30 | ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library… |
CVE-2024-48955 | High | 8.1 | 2024-10-29 | Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this cal… |
CVE-2024-10241 | Medium | 4.3 | 2024-10-29 | Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by u… |
CVE-2024-47481 | Medium | 6.5 | 2024-10-25 | Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacent network access… |
CVE-2024-10353 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. T… |
CVE-2024-48932 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1… |
CVE-2024-9692 | | 2024-10-24 | VIMESA VHF/FM Transmitter Blue Plus is suffering from a Denial-of-Service (DoS) vulnerability. An unauthenticated attacker can issue an unauthorized HTTP GET r… | |
CVE-2024-45334 | High | 7.8 | 2024-10-22 | Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to produ… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2020-36838 | High | 7.4 | 2024-10-16 | The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versio… |
CVE-2020-36831 | Medium | 5.0 | 2024-10-16 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privi… |
CVE-2024-38204 | High | 7.5 | 2024-10-15 | Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. |
CVE-2024-21248 | Medium | 5.3 | 2024-10-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and pr… |
CVE-2024-21247 | Low | 3.8 | 2024-10-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21195 | High | 7.6 | 2024-10-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions that are affected are 7.0.0.0.0, 7.6.0… |
CVE-2024-45735 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a l… |
CVE-2024-45734 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the ma… |
CVE-2024-45397 | Medium | 5.9 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets… |
CVE-2024-45149 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45135 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45133 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a securi… |
CVE-2024-45130 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |