CWE-284 · Improper Access Control (page 57)
Page 57 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29221 | Medium | 4.7 | 2024-04-05 | Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access cont… |
CVE-2024-21848 | Low | 3.1 | 2024-04-05 | Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in… |
CVE-2024-31207 | Medium | 5.9 | 2024-04-04 | Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does… |
CVE-2024-30261 | Low | 2.6 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept… |
CVE-2023-36644 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin. |
CVE-2023-36643 | High | 7.5 | 2024-04-04 | Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer fun… |
CVE-2024-1418 | Medium | 5.3 | 2024-04-04 | The CGC Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 via the REST API. This… |
CVE-2024-3270 | Low | 3.8 | 2024-04-03 | A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The m… |
CVE-2024-20302 | Medium | 5.4 | 2024-04-03 | A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or de… |
CVE-2024-20283 | Medium | 4.3 | 2024-04-03 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This v… |
CVE-2024-27605 | High | 7.5 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system. |
CVE-2024-27602 | Critical | 9.1 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs… |
CVE-2024-3164 | Medium | 4.5 | 2024-04-01 | In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone wi… |
CVE-2024-28405 | High | 7.2 | 2024-03-29 | SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page becau… |
CVE-2024-28960 | High | 8.2 | 2024-03-29 | An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. |
CVE-2024-28016 | Medium | 6.0 | 2024-03-28 | Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-M… |
CVE-2024-25962 | High | 8.3 | 2024-03-27 | Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could potentially exploit this vulnerability… |
CVE-2024-25736 | High | 7.5 | 2024-03-27 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request. |
CVE-2023-50702 | High | 8.8 | 2024-03-26 | Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write acc… |
CVE-2024-29866 | Critical | 9.1 | 2024-03-21 | Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System… |
CVE-2024-25811 | Medium | 6.5 | 2024-03-21 | An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. |
CVE-2023-49978 | High | 8.8 | 2024-03-21 | Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administr… |
CVE-2020-26942 | Critical | 9.1 | 2024-03-21 | An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword op… |
CVE-2024-1473 | Medium | 5.3 | 2024-03-20 | The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the… |
CVE-2024-1144 | Medium | 6.5 | 2024-03-19 | Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user t… |
CVE-2024-20767 | High | 7.4 | 2024-03-18 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2021-47155 | Critical | 9.1 | 2024-03-18 | The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attacke… |
CVE-2022-47037 | High | 7.5 | 2024-03-18 | Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. |
CVE-2022-47036 | Critical | 9.8 | 2024-03-18 | Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be… |
CVE-2024-2481 | Medium | 6.5 | 2024-03-15 | A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2024-28390 | Critical | 9.8 | 2024-03-14 | An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive info… |
CVE-2024-25653 | Medium | 4.3 | 2024-03-14 | Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view sy… |
CVE-2024-20322 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthent… |
CVE-2024-20319 | Medium | 4.3 | 2024-03-13 | A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane pro… |
CVE-2024-20315 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2024-1668 | Medium | 6.5 | 2024-03-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.1… |
CVE-2024-1462 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes… |
CVE-2024-1370 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hoo… |
CVE-2024-0687 | Medium | 5.3 | 2024-03-13 | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu… |
CVE-2024-0631 | Medium | 5.3 | 2024-03-13 | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_respon… |
CVE-2024-0377 | Medium | 5.3 | 2024-03-13 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-0369 | Medium | 4.3 | 2024-03-13 | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2024-28338 | High | 8.0 | 2024-03-12 | A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie. |
CVE-2024-26203 | High | 7.3 | 2024-03-12 | Azure Data Studio Elevation of Privilege Vulnerability |
CVE-2024-26201 | Medium | 6.6 | 2024-03-12 | Microsoft Intune Linux Agent Elevation of Privilege Vulnerability |
CVE-2024-21436 | High | 7.8 | 2024-03-12 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-21418 | High | 7.8 | 2024-03-12 | Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability |
CVE-2023-36554 | High | 8.1 | 2024-03-12 | A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2… |
CVE-2024-21483 | Medium | 4.6 | 2024-03-12 | A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003… |
CVE-2022-32257 | Critical | 9.8 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper… |
CVE-2024-21805 | High | 7.8 | 2024-03-12 | Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is… |
CVE-2024-28120 | Medium | 6.5 | 2024-03-11 | codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender… |
CVE-2024-25501 | High | 8.8 | 2024-03-09 | An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter. |
CVE-2024-2281 | Medium | 6.3 | 2024-03-08 | A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2024-23267 | Medium | 5.5 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to bypa… |
CVE-2024-23266 | Medium | 5.5 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to modi… |
CVE-2024-23238 | Low | 3.3 | 2024-03-08 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables. |
CVE-2024-0258 | High | 8.6 | 2024-03-08 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may… |
CVE-2024-28115 | High | 8.8 | 2024-03-07 | FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege esca… |
CVE-2023-51786 | Critical | 9.1 | 2024-03-07 | An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensitive information v… |
CVE-2023-43318 | High | 8.8 | 2024-03-06 | TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET r… |
CVE-2023-38946 | High | 8.8 | 2024-03-06 | An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the app… |
CVE-2023-38945 | Critical | 9.8 | 2024-03-06 | Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows a… |
CVE-2024-1898 | Medium | 4.3 | 2024-03-05 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings… |
CVE-2024-1478 | Medium | 5.3 | 2024-03-05 | The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This ma… |
CVE-2024-1088 | Medium | 5.3 | 2024-03-05 | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-20036 | Medium | 4.4 | 2024-03-04 | In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges ne… |
CVE-2024-0795 | High | 7.2 | 2024-03-02 | If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating… |
CVE-2023-49545 | High | 7.5 | 2024-03-01 | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiri… |
CVE-2023-49543 | Critical | 9.8 | 2024-03-01 | Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenti… |
CVE-2024-21767 | Critical | 9.4 | 2024-03-01 | A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request. |
CVE-2024-27497 | High | 8.8 | 2024-03-01 | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. |
CVE-2024-1942 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, w… |
CVE-2024-1888 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members… |
CVE-2024-23488 | Low | 3.1 | 2024-02-29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived… |
CVE-2024-1887 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to… |
CVE-2024-25830 | Critical | 9.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can explo… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-1492 | Medium | 5.3 | 2024-02-29 | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function i… |
CVE-2024-1475 | Medium | 5.3 | 2024-02-29 | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST… |
CVE-2024-1472 | Medium | 5.3 | 2024-02-29 | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possi… |
CVE-2024-1294 | Medium | 5.3 | 2024-02-29 | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2024-1288 | Medium | 4.3 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sas… |
CVE-2024-1044 | Medium | 5.3 | 2024-02-29 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_r… |
CVE-2024-0978 | Medium | 5.3 | 2024-02-29 | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This ma… |
CVE-2023-51774 | High | 8.4 | 2024-02-29 | The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can someti… |
CVE-2023-49931 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49930 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2022-34270 | Critical | 9.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager. |
CVE-2024-25169 | Critical | 9.8 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. |
CVE-2024-1632 | High | 8.8 | 2024-02-28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. |
CVE-2024-22459 | Medium | 6.8 | 2024-02-28 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote h… |
CVE-2024-1476 | Medium | 5.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-0975 | Medium | 5.3 | 2024-02-28 | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST AP… |
CVE-2024-0766 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2024-25723 | High | 8.8 | 2024-02-27 | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/acti… |
CVE-2024-0551 | High | 7.1 | 2024-02-27 | Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access… |
CVE-2024-24568 | Medium | 5.3 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTT… |
CVE-2021-33162 | High | 8.4 | 2024-02-23 | Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authenticated user to pote… |