CWE-284 · Improper Access Control (page 53)
Page 53 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45129 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privi… |
CVE-2024-45124 | Medium | 5.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45122 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45121 | Medium | 4.3 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45118 | Medium | 6.5 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-42988 | Medium | 4.3 | 2024-10-09 | Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of u… |
CVE-2024-46539 | High | 8.2 | 2024-10-08 | Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a Denial of Service (… |
CVE-2024-43590 | High | 7.8 | 2024-10-08 | Visual C++ Redistributable Installer Elevation of Privilege Vulnerability |
CVE-2024-43503 | High | 7.8 | 2024-10-08 | Microsoft SharePoint Elevation of Privilege Vulnerability |
CVE-2024-43456 | Medium | 4.8 | 2024-10-08 | Windows Remote Desktop Services Tampering Vulnerability |
CVE-2024-47976 | Medium | 6.7 | 2024-10-07 | Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access. |
CVE-2024-47975 | High | 7.0 | 2024-10-07 | Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attack… |
CVE-2024-9576 | High | 7.0 | 2024-10-07 | Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script. |
CVE-2024-47910 | High | 7.2 | 2024-10-04 | An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing con… |
CVE-2023-26770 | Critical | 9.8 | 2024-10-04 | TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user. |
CVE-2024-45870 | Medium | 6.5 | 2024-10-03 | Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file. |
CVE-2024-42514 | High | 8.1 | 2024-10-01 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthor… |
CVE-2024-45408 | High | 7.5 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to acc… |
CVE-2024-46280 | High | 8.8 | 2024-09-30 | PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, wi… |
CVE-2024-9321 | Medium | 5.3 | 2024-09-29 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2024-9298 | Medium | 4.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |
CVE-2024-46097 | High | 8.1 | 2024-09-27 | TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is a… |
CVE-2024-46627 | Critical | 9.1 | 2024-09-26 | Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. |
CVE-2024-45982 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password res… |
CVE-2024-44860 | High | 7.5 | 2024-09-26 | An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request. |
CVE-2024-41605 | High | 8.4 | 2024-09-26 | In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan horse via side loa… |
CVE-2024-47145 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker… |
CVE-2024-42406 | Medium | 5.4 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is… |
CVE-2024-20465 | Medium | 5.8 | 2024-09-25 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches co… |
CVE-2024-46610 | High | 7.5 | 2024-09-25 | An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted P… |
CVE-2024-46609 | High | 7.5 | 2024-09-25 | An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all… |
CVE-2024-46607 | High | 7.6 | 2024-09-25 | Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the log… |
CVE-2024-42797 | Critical | 9.8 | 2024-09-25 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability all… |
CVE-2024-45489 | Critical | 9.8 | 2024-09-20 | Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigu… |
CVE-2024-9003 | Medium | 4.3 | 2024-09-19 | A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController o… |
CVE-2024-38016 | High | 7.8 | 2024-09-19 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2024-45811 | Medium | 4.8 | 2024-09-17 | Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies acces… |
CVE-2024-40825 | Medium | 4.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with root privileges may be able to modify t… |
CVE-2024-42796 | Medium | 5.9 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows… |
CVE-2024-42795 | Medium | 4.2 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management Sy… |
CVE-2024-42794 | Medium | 4.7 | 2024-09-16 | Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user. |
CVE-2024-36261 | Low | 3.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent… |
CVE-2024-36247 | Medium | 4.6 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access. |
CVE-2024-34543 | Medium | 6.7 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-32940 | Medium | 6.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adja… |
CVE-2024-28170 | Low | 3.3 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2023-43626 | High | 7.5 | 2024-09-16 | Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acces… |
CVE-2024-39772 | Low | 3.7 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots vi… |
CVE-2024-8779 | High | 8.8 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privil… |
CVE-2024-8269 | High | 7.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and… |
CVE-2024-44571 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php. |
CVE-2024-20343 | Medium | 5.5 | 2024-09-11 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux op… |
CVE-2024-43492 | High | 7.8 | 2024-09-10 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2024-43479 | High | 8.5 | 2024-09-10 | Microsoft Power Automate Desktop Remote Code Execution Vulnerability |
CVE-2024-38220 | Critical | 9.0 | 2024-09-10 | Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2024-37341 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2023-37234 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum through 4.6 has unprotected JMX Registry. |
CVE-2024-45323 | Medium | 4.3 | 2024-09-10 | An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an a… |
CVE-2024-37993 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-39580 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could pote… |
CVE-2024-6796 | High | 8.2 | 2024-09-09 | In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker… |
CVE-2024-42023 | High | 8.8 | 2024-09-07 | An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. |
CVE-2024-42022 | Medium | 5.3 | 2024-09-07 | An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. |
CVE-2024-42021 | Medium | 6.5 | 2024-09-07 | An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. |
CVE-2023-30587 | High | 7.5 | 2024-09-07 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:ins… |
CVE-2023-30583 | High | 7.5 | 2024-09-07 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This fl… |
CVE-2023-30582 | Medium | 5.3 | 2024-09-07 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2024-45392 | High | 7.7 | 2024-09-05 | SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat… |
CVE-2024-45170 | High | 8.1 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-45522 | Critical | 9.8 | 2024-09-02 | Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgo… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-45233 | Critical | 9.8 | 2024-08-29 | An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insu… |
CVE-2024-44915 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44914 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44913 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-20279 | Medium | 4.3 | 2024-08-28 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2024-8216 | Medium | 5.4 | 2024-08-27 | A vulnerability, which was classified as critical, has been found in nafisulbari/itsourcecode Insurance Management System 1.0. Affected by this issue is some u… |
CVE-2024-5814 | Medium | 5.3 | 2024-08-27 | A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection… |
CVE-2024-36068 | Critical | 9.8 | 2024-08-27 | An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute a… |
CVE-2024-8164 | Medium | 6.3 | 2024-08-26 | A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controll… |
CVE-2024-43031 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 was discovered to contain an access control issue. |
CVE-2024-42766 | Medium | 5.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. |
CVE-2024-40766 | Critical | 9.8 | 2024-08-23 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an… |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |
CVE-2024-42776 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. |
CVE-2024-42775 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticate… |
CVE-2024-42772 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to… |
CVE-2024-43780 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload fil… |
CVE-2024-42497 | Medium | 6.0 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems mana… |
CVE-2024-40884 | Low | 2.7 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission… |
CVE-2024-3127 | Medium | 4.3 | 2024-08-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions… |
CVE-2024-36441 | Medium | 5.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by th… |
CVE-2024-36443 | High | 7.6 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP. |
CVE-2024-8071 | Medium | 4.7 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which a… |
CVE-2024-43813 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |
CVE-2024-38175 | Critical | 9.6 | 2024-08-20 | An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a netwo… |
CVE-2024-42919 | Critical | 9.8 | 2024-08-20 | eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. |