CWE-284 · Improper Access Control (page 56)
Page 56 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40071 | High | 7.3 | 2024-05-16 | Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-40070 | High | 8.8 | 2024-05-16 | Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-39433 | Medium | 4.4 | 2024-05-16 | Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-37410 | High | 7.0 | 2024-05-16 | Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-37341 | High | 7.2 | 2024-05-16 | Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentia… |
CVE-2024-4263 | Medium | 5.4 | 2024-05-16 | A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can… |
CVE-2024-28087 | Medium | 6.5 | 2024-05-15 | In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition an… |
CVE-2024-34099 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code exe… |
CVE-2024-0437 | Medium | 4.3 | 2024-05-15 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Expos… |
CVE-2024-30059 | Medium | 6.1 | 2024-05-14 | Microsoft Intune for Android Mobile Application Management Tampering Vulnerability |
CVE-2024-33647 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper acc… |
CVE-2024-2749 | Medium | 5.9 | 2024-05-14 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permittin… |
CVE-2024-27841 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An app may be able to disclose kerne… |
CVE-2024-27803 | Low | 2.4 | 2024-05-14 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to sh… |
CVE-2024-27790 | High | 7.5 | 2024-05-14 | Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue ha… |
CVE-2024-1230 | Medium | 4.3 | 2024-05-14 | The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorre… |
CVE-2022-32507 | High | 8.8 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts… |
CVE-2024-0025 | High | 7.8 | 2024-05-07 | In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of… |
CVE-2024-29207 | High | 7.5 | 2024-05-07 | An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: Uni… |
CVE-2024-29206 | Low | 2.2 | 2024-05-07 | An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the syst… |
CVE-2023-6810 | Medium | 4.3 | 2024-05-07 | The ClickCease Click Fraud Protection plugin for WordPress is vulnerable to unauthorized access of data due to an improper capability check on the get_settings… |
CVE-2024-23351 | High | 8.4 | 2024-05-06 | Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2024-34404 | Medium | 6.8 | 2024-05-03 | A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the clou… |
CVE-2024-33396 | High | 8.4 | 2024-05-02 | An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-1678 | Medium | 5.3 | 2024-05-02 | The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST… |
CVE-2024-1584 | Medium | 5.3 | 2024-05-02 | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2024-31967 | Critical | 9.1 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-31964 | High | 7.5 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-33393 | Medium | 6.2 | 2024-05-01 | An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-22830 | Medium | 5.3 | 2024-05-01 | Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allo… |
CVE-2024-32973 | Medium | 4.8 | 2024-05-01 | Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network tra… |
CVE-2024-28978 | Medium | 5.2 | 2024-05-01 | Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. A high privileged remote attacker could potentially explo… |
CVE-2024-3746 | Medium | 5.5 | 2024-04-30 | The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write o… |
CVE-2023-49473 | Critical | 9.8 | 2024-04-30 | Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable to Incorrect Access… |
CVE-2024-4225 | High | 7.6 | 2024-04-30 | Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit (RTU), by DPS Telecom. Attackers can exploit th… |
CVE-2024-33260 | Medium | 5.1 | 2024-04-26 | Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c |
CVE-2024-4198 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin… |
CVE-2024-4195 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team ad… |
CVE-2024-33673 | High | 7.8 | 2024-04-26 | An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path. |
CVE-2024-33666 | High | 8.6 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API… |
CVE-2024-23271 | Medium | 6.5 | 2024-04-24 | A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A m… |
CVE-2023-38298 | High | 8.8 | 2024-04-22 | Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on… |
CVE-2023-38297 | High | 8.4 | 2024-04-22 | An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for var… |
CVE-2023-38296 | High | 8.0 | 2024-04-22 | Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device w… |
CVE-2024-27348 | Critical | 9.8 | 2024-04-22 | RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Us… |
CVE-2024-22811 | High | 8.2 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-22807 | Medium | 6.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose… |
CVE-2024-32418 | Critical | 9.8 | 2024-04-22 | An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component. |
CVE-2024-31846 | High | 7.5 | 2024-04-19 | An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from an unauthorized acto… |
CVE-2024-30107 | Low | 3.5 | 2024-04-18 | HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios. |
CVE-2023-45744 | High | 8.3 | 2024-04-17 | A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially craft… |
CVE-2023-45209 | Medium | 5.3 | 2024-04-17 | An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A spec… |
CVE-2023-43491 | Medium | 5.3 | 2024-04-17 | An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially… |
CVE-2024-31503 | High | 7.5 | 2024-04-17 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protect… |
CVE-2024-31759 | High | 8.8 | 2024-04-16 | An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function. |
CVE-2024-21115 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21114 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21113 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21112 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21110 | High | 7.3 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21107 | Medium | 6.7 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21103 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21091 | Medium | 6.5 | 2024-04-16 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Data Import). The supported version tha… |
CVE-2024-21084 | Medium | 5.8 | 2024-04-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Service Gateway). Supported versions that are affected are 7.0.0.0.0 and 12… |
CVE-2024-21076 | High | 7.5 | 2024-04-16 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Offer LOV). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2024-21074 | High | 7.5 | 2024-04-16 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Finance LOV). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21071 | Critical | 9.1 | 2024-04-16 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12… |
CVE-2024-21067 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). The supported version that is… |
CVE-2024-20992 | Medium | 4.4 | 2024-04-16 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). The supported version that is affected is… |
CVE-2024-24487 | Medium | 6.8 | 2024-04-15 | An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC RE… |
CVE-2024-24486 | Critical | 9.1 | 2024-04-15 | An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command. |
CVE-2024-24485 | High | 7.5 | 2024-04-15 | An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command. |
CVE-2024-29843 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing f… |
CVE-2024-29842 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIE… |
CVE-2024-29841 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS… |
CVE-2024-29840 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS… |
CVE-2024-29839 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allow… |
CVE-2024-29837 | High | 8.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce… |
CVE-2024-29836 | Critical | 9.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated att… |
CVE-2024-3765 | Critical | 9.8 | 2024-04-14 | A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R8… |
CVE-2024-25852 | High | 8.8 | 2024-04-11 | Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. A… |
CVE-2024-2217 | High | 7.5 | 2024-04-10 | gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in b… |
CVE-2024-2731 | Medium | 5.4 | 2024-04-10 | Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such… |
CVE-2024-1308 | High | 7.5 | 2024-04-09 | The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permali… |
CVE-2024-0899 | Medium | 5.3 | 2024-04-09 | The s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerab… |
CVE-2024-0626 | Medium | 5.3 | 2024-04-09 | The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callbac… |
CVE-2024-29993 | High | 8.8 | 2024-04-09 | Azure CycleCloud Elevation of Privilege Vulnerability |
CVE-2024-29990 | Critical | 9.0 | 2024-04-09 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-29055 | High | 7.2 | 2024-04-09 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2024-29054 | High | 7.2 | 2024-04-09 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2024-28922 | Medium | 4.1 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-28917 | Medium | 6.2 | 2024-04-09 | Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability |
CVE-2024-26234 | Medium | 6.7 | 2024-04-09 | Proxy Driver Spoofing Vulnerability |
CVE-2024-21424 | Medium | 6.5 | 2024-04-09 | Azure Compute Gallery Elevation of Privilege Vulnerability |
CVE-2024-31805 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg f… |
CVE-2024-27895 | High | 7.5 | 2024-04-08 | Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-52537 | High | 7.5 | 2024-04-08 | Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30418 | High | 7.5 | 2024-04-07 | Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availabil… |
CVE-2024-2447 | Medium | 6.5 | 2024-04-05 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos… |