CWE-284 · Improper Access Control (page 54)
Page 54 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27187 | High | 7.5 | 2024-08-20 | Improper Access Controls allows backend users to overwrite their username when disallowed. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-43397 | Medium | 4.3 | 2024-08-20 | Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests t… |
CVE-2024-43377 | Medium | 5.4 | 2024-08-20 | Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. |
CVE-2024-42559 | Critical | 9.8 | 2024-08-20 | An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid passwor… |
CVE-2024-7921 | Medium | 4.3 | 2024-08-19 | A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this… |
CVE-2024-7920 | Medium | 4.3 | 2024-08-19 | A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is a… |
CVE-2024-7919 | Medium | 5.3 | 2024-08-19 | A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue… |
CVE-2024-6221 | High | 7.5 | 2024-08-18 | A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavi… |
CVE-2024-42967 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-28050 | Medium | 5.0 | 2024-08-14 | Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially ena… |
CVE-2024-26022 | High | 7.8 | 2024-08-14 | Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated user to potentially enable escalation of… |
CVE-2024-25576 | High | 7.9 | 2024-08-14 | improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to enable escalation of privilege via local… |
CVE-2024-24986 | High | 8.8 | 2024-08-14 | Improper access control in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated… |
CVE-2023-43489 | Medium | 5.5 | 2024-08-14 | Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to potentially enable denial of service via loc… |
CVE-2024-39414 | Medium | 4.3 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Secur… |
CVE-2024-38163 | High | 7.8 | 2024-08-14 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-38223 | Medium | 6.8 | 2024-08-13 | Windows Initial Machine Configuration Elevation of Privilege Vulnerability |
CVE-2024-38195 | High | 7.8 | 2024-08-13 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-38162 | High | 7.8 | 2024-08-13 | Azure Connected Machine Agent Elevation of Privilege Vulnerability |
CVE-2023-31341 | High | 7.3 | 2024-08-13 | Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of-bounds write, pote… |
CVE-2024-36505 | Medium | 5.1 | 2024-08-13 | An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker w… |
CVE-2024-41905 | Medium | 6.8 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control f… |
CVE-2024-41732 | Medium | 4.7 | 2024-08-13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web app… |
CVE-2024-42480 | High | 8.1 | 2024-08-12 | Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd ro… |
CVE-2024-41332 | Medium | 6.5 | 2024-08-12 | Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-l… |
CVE-2024-40480 | Critical | 9.8 | 2024-08-12 | A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthe… |
CVE-2024-40475 | High | 8.8 | 2024-08-12 | SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /… |
CVE-2024-29082 | High | 8.6 | 2024-08-12 | Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enab… |
CVE-2024-0104 | Medium | 4.2 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A success… |
CVE-2024-42354 | Medium | 5.3 | 2024-08-08 | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiA… |
CVE-2024-42033 | Medium | 6.9 | 2024-08-08 | Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-38202 | High | 7.3 | 2024-08-08 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileg… |
CVE-2024-21302 | Medium | 6.7 | 2024-08-08 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-… |
CVE-2024-41912 | Critical | 9.8 | 2024-08-07 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access con… |
CVE-2024-41250 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41245 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41244 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41243 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41309 | High | 7.8 | 2024-08-07 | An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privi… |
CVE-2024-41308 | High | 7.8 | 2024-08-07 | An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on… |
CVE-2024-41252 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kaship… |
CVE-2024-41251 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kaship… |
CVE-2024-41249 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unau… |
CVE-2024-41248 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System… |
CVE-2024-41247 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2… |
CVE-2024-41246 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote u… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-7525 | High | 8.1 | 2024-08-06 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on… |
CVE-2024-40531 | High | 8.8 | 2024-08-05 | A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, includin… |
CVE-2024-33027 | High | 8.4 | 2024-08-05 | Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table. |
CVE-2024-41518 | High | 7.5 | 2024-08-02 | An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX fi… |
CVE-2024-41926 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malici… |
CVE-2024-41162 | Medium | 4.1 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when sha… |
CVE-2024-41144 | Medium | 5.5 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, w… |
CVE-2024-39839 | Medium | 4.3 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channel… |
CVE-2024-39837 | Low | 3.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, whe… |
CVE-2024-39777 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels… |
CVE-2024-39274 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync messa… |
CVE-2024-36492 | High | 7.4 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in share… |
CVE-2024-29977 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remot… |
CVE-2024-5331 | Medium | 4.3 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authen… |
CVE-2024-38909 | Critical | 9.8 | 2024-07-30 | Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrar… |
CVE-2024-40822 | Low | 2.4 | 2024-07-29 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macO… |
CVE-2024-40812 | High | 7.8 | 2024-07-29 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS S… |
CVE-2024-40786 | High | 7.5 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8… |
CVE-2023-42957 | Low | 3.3 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10. An app may be able to… |
CVE-2024-28805 | Critical | 9.1 | 2024-07-29 | An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control. |
CVE-2024-6727 | Medium | 5.4 | 2024-07-29 | A flaw in versions of Delphix Data Control Tower (DCT) prior to 19.0.0 results in broken authentication through the enable-scale-testing functionality of the a… |
CVE-2024-7154 | Medium | 4.3 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.h… |
CVE-2024-40117 | Critical | 9.8 | 2024-07-26 | Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the we… |
CVE-2024-41806 | Medium | 5.3 | 2024-07-25 | The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor da… |
CVE-2024-7057 | Medium | 4.3 | 2024-07-25 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and star… |
CVE-2024-36535 | Critical | 9.8 | 2024-07-24 | Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36537 | High | 7.2 | 2024-07-24 | Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-38164 | Critical | 9.6 | 2024-07-23 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on… |
CVE-2024-41703 | Critical | 9.8 | 2024-07-22 | LibreChat through 0.7.4-rc1 has incorrect access control for message updates. |
CVE-2024-41600 | High | 7.5 | 2024-07-19 | Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in th… |
CVE-2024-21169 | Medium | 6.5 | 2024-07-16 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Partners). Supported versions that are affected are 12.2.3-12.2.13. Easil… |
CVE-2024-21153 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). The supported… |
CVE-2024-21150 | Medium | 6.1 | 2024-07-16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2024-21145 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |
CVE-2024-21132 | Medium | 5.4 | 2024-07-16 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.13. Eas… |
CVE-2019-16640 | High | 7.5 | 2024-07-16 | An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not ch… |
CVE-2024-37386 | Medium | 4.2 | 2024-07-15 | An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in s… |
CVE-2024-36438 | High | 7.3 | 2024-07-15 | eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to card duplication and… |
CVE-2024-6738 | Medium | 5.3 | 2024-07-15 | The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modi… |
CVE-2024-6737 | High | 8.8 | 2024-07-15 | The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regu… |
CVE-2024-40547 | Medium | 6.5 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
CVE-2024-6385 | Critical | 9.6 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-5257 | Medium | 4.9 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `ad… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-37147 | Medium | 4.3 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-34725 | High | 7.0 | 2024-07-09 | In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of pri… |
CVE-2024-31320 | High | 7.8 | 2024-07-09 | In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This cou… |
CVE-2024-38100 | High | 7.8 | 2024-07-09 | Windows File Explorer Elevation of Privilege Vulnerability |
CVE-2024-38061 | High | 7.5 | 2024-07-09 | DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability |
CVE-2024-23663 | High | 8.8 | 2024-07-09 | An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to… |
CVE-2023-50181 | Medium | 4.9 | 2024-07-09 | An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker… |