CWE-284 · Improper Access Control (page 55)
Page 55 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39697 | High | 8.6 | 2024-07-09 | phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic… |
CVE-2024-39701 | Medium | 6.3 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evalua… |
CVE-2024-39943 | Critical | 9.9 | 2024-07-04 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload pe… |
CVE-2024-39934 | High | 7.8 | 2024-07-04 | Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotre… |
CVE-2024-6428 | Medium | 5.3 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attack… |
CVE-2024-39361 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an a… |
CVE-2024-36257 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A request… |
CVE-2024-36989 | High | 7.1 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold th… |
CVE-2024-38518 | Medium | 4.6 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick… |
CVE-2024-38371 | High | 8.6 | 2024-06-28 | authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This cou… |
CVE-2024-37905 | High | 8.8 | 2024-06-28 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin… |
CVE-2024-39376 | Critical | 9.8 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to users gaining unauthorized access to sensitive information or performing actions beyond their designated permi… |
CVE-2024-5655 | Critical | 9.6 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-5430 | Medium | 6.8 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-2191 | Medium | 5.3 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-37742 | High | 8.2 | 2024-06-25 | Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode… |
CVE-2024-21741 | Critical | 9.8 | 2024-06-25 | GigaDevice GD32E103C8T6 devices have Incorrect Access Control. |
CVE-2024-21740 | High | 7.4 | 2024-06-25 | Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. |
CVE-2024-33898 | Critical | 9.8 | 2024-06-24 | Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote atta… |
CVE-2024-37677 | High | 7.5 | 2024-06-24 | An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information. |
CVE-2024-38873 | Medium | 5.3 | 2024-06-21 | An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check th… |
CVE-2022-45929 | High | 8.8 | 2024-06-20 | Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and cou… |
CVE-2022-41324 | Medium | 6.5 | 2024-06-20 | Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensiti… |
CVE-2024-38273 | Medium | 5.4 | 2024-06-18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
CVE-2022-23829 | High | 8.2 | 2024-06-18 | A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode… |
CVE-2024-5650 | High | 8.5 | 2024-06-17 | DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into… |
CVE-2024-37887 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that t… |
CVE-2024-37884 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with… |
CVE-2024-37883 | Medium | 4.3 | 2024-06-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2024-37317 | Medium | 4.6 | 2024-06-14 | The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created use… |
CVE-2024-37315 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the f… |
CVE-2024-37314 | Low | 3.5 | 2024-06-14 | Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded… |
CVE-2024-37312 | Medium | 6.3 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventuall… |
CVE-2024-37279 | Medium | 4.3 | 2024-06-13 | A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting… |
CVE-2024-28969 | Medium | 4.3 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28968 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST API… |
CVE-2024-28967 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by… |
CVE-2024-28966 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28965 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by Admi… |
CVE-2024-34112 | High | 7.5 | 2024-06-13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2024-34107 | Medium | 5.3 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Securit… |
CVE-2024-26029 | High | 7.5 | 2024-06-13 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A… |
CVE-2024-5840 | Medium | 6.5 | 2024-06-11 | Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromi… |
CVE-2024-29060 | Medium | 6.7 | 2024-06-11 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2024-5687 | Medium | 5.3 | 2024-06-11 | If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The trigge… |
CVE-2024-37289 | High | 7.8 | 2024-06-10 | An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2024-27855 | High | 8.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, macOS Ventura 1… |
CVE-2024-27819 | Low | 2.4 | 2024-06-10 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access ma… |
CVE-2024-27792 | Medium | 5.5 | 2024-06-10 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive… |
CVE-2022-48683 | High | 7.8 | 2024-06-10 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may be able to break out of its sandbox. |
CVE-2024-37568 | High | 7.5 | 2024-06-09 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is a… |
CVE-2024-30481 | Medium | 6.5 | 2024-06-09 | Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0. |
CVE-2023-6491 | Medium | 4.3 | 2024-06-07 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sti… |
CVE-2024-22074 | Critical | 9.8 | 2024-06-06 | Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1… |
CVE-2024-36399 | High | 8.2 | 2024-06-06 | Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(… |
CVE-2024-0972 | Medium | 5.3 | 2024-06-06 | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API… |
CVE-2023-6968 | High | 8.1 | 2024-06-06 | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or inco… |
CVE-2023-6966 | High | 8.1 | 2024-06-06 | The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check… |
CVE-2024-28818 | Medium | 5.9 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280… |
CVE-2024-2019 | High | 7.5 | 2024-06-04 | The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capab… |
CVE-2024-23360 | High | 8.4 | 2024-06-03 | Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers. |
CVE-2024-20065 | Medium | 4.0 | 2024-06-03 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2024-35433 | High | 8.1 | 2024-05-30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new adm… |
CVE-2024-0434 | Medium | 5.3 | 2024-05-29 | The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2023-43849 | Medium | 6.5 | 2024-05-28 | Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmwar… |
CVE-2023-43848 | High | 8.0 | 2024-05-28 | Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter loc… |
CVE-2023-43847 | Medium | 5.3 | 2024-05-28 | Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all th… |
CVE-2024-23315 | High | 7.5 | 2024-05-28 | A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specia… |
CVE-2024-22187 | Critical | 9.1 | 2024-05-28 | A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A… |
CVE-2023-52712 | High | 7.8 | 2024-05-28 | Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previou… |
CVE-2023-52711 | High | 7.8 | 2024-05-28 | Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previou… |
CVE-2024-5272 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event… |
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-1376 | Medium | 4.3 | 2024-05-24 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all… |
CVE-2024-35222 | Medium | 5.9 | 2024-05-23 | Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints with… |
CVE-2024-5168 | Critical | 9.8 | 2024-05-23 | Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated use… |
CVE-2024-26139 | High | 8.3 | 2024-05-23 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security… |
CVE-2024-32969 | Low | 2.7 | 2024-05-23 | vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that… |
CVE-2024-22026 | Medium | 6.7 | 2024-05-22 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary command… |
CVE-2024-27264 | High | 7.4 | 2024-05-22 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-20261 | Medium | 5.8 | 2024-05-22 | A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2024-33227 | High | 8.8 | 2024-05-22 | An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IO… |
CVE-2024-0453 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback fun… |
CVE-2024-0452 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback fun… |
CVE-2024-0451 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in… |
CVE-2023-52801 | High | 8.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split… |
CVE-2024-4988 | High | 7.5 | 2024-05-21 | The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage. |
CVE-2024-36080 | Critical | 9.8 | 2024-05-19 | Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is a serial-to-Etherne… |
CVE-2024-21828 | Medium | 6.7 | 2024-05-16 | Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially e… |
CVE-2023-47859 | Medium | 5.5 | 2024-05-16 | Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to potentially enable de… |
CVE-2023-45217 | High | 8.8 | 2024-05-16 | Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-43748 | High | 7.8 | 2024-05-16 | Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalati… |
CVE-2023-43487 | Medium | 4.7 | 2024-05-16 | Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of service via local access. |