CWE-284 · Improper Access Control (page 58)
Page 58 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1823 | Medium | 5.3 | 2024-02-23 | A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-1053 | Medium | 4.3 | 2024-02-22 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in… |
CVE-2024-25251 | High | 8.8 | 2024-02-22 | code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. |
CVE-2024-26310 | Medium | 4.3 | 2024-02-21 | Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploi… |
CVE-2024-20325 | Medium | 5.1 | 2024-02-21 | A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a reposi… |
CVE-2024-1701 | Medium | 5.3 | 2024-02-21 | A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2023-42945 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth. |
CVE-2023-42859 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modi… |
CVE-2023-42853 | Medium | 5.5 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to… |
CVE-2023-42838 | High | 8.6 | 2024-02-21 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app m… |
CVE-2024-1675 | High | 8.8 | 2024-02-21 | Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted H… |
CVE-2023-47422 | High | 8.8 | 2024-02-20 | An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX12 V1 V22.03.01.46 a… |
CVE-2024-22234 | High | 7.4 | 2024-02-20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly use… |
CVE-2022-45320 | Medium | 6.3 | 2024-02-20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become… |
CVE-2023-6259 | High | 7.1 | 2024-02-19 | Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical… |
CVE-2023-50257 | Critical | 9.6 | 2024-02-19 | eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the applicat… |
CVE-2024-25981 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided… |
CVE-2024-25980 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided addit… |
CVE-2024-1343 | Medium | 4.7 | 2024-02-19 | A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup… |
CVE-2023-52375 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the WindowManagerServices module.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-52367 | High | 7.7 | 2024-02-18 | Vulnerability of improper access control in the media library module.Successful exploitation of this vulnerability may affect service availability and integrit… |
CVE-2024-20951 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |
CVE-2024-20931 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20929 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are… |
CVE-2024-20927 | High | 8.6 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20911 | Low | 2.6 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-0036 | High | 7.8 | 2024-02-16 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background… |
CVE-2024-0032 | Medium | 6.5 | 2024-02-16 | In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to loca… |
CVE-2023-39244 | High | 7.3 | 2024-02-15 | DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthentica… |
CVE-2024-24386 | High | 7.2 | 2024-02-15 | An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. |
CVE-2024-24300 | Critical | 9.8 | 2024-02-14 | 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, th… |
CVE-2023-40161 | Medium | 6.6 | 2024-02-14 | Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-39941 | High | 7.1 | 2024-02-14 | Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via ad… |
CVE-2023-39432 | Medium | 6.7 | 2024-02-14 | Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticated user to potential… |
CVE-2023-39425 | High | 8.8 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-38561 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-35121 | High | 7.8 | 2024-02-14 | Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow… |
CVE-2023-35062 | Medium | 6.3 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2023-33875 | High | 7.1 | 2024-02-14 | Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to pot… |
CVE-2023-32647 | Medium | 6.8 | 2024-02-14 | Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-31271 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-28715 | Medium | 5.0 | 2024-02-14 | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially e… |
CVE-2023-28396 | Medium | 6.1 | 2024-02-14 | Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privileged user to enable denial of service via… |
CVE-2023-27517 | Medium | 6.6 | 2024-02-14 | Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an athenticated user to… |
CVE-2023-27303 | Low | 3.8 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inform… |
CVE-2023-27301 | Medium | 4.2 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-26596 | Low | 2.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-26585 | Medium | 5.0 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-25777 | High | 7.9 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-25174 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalatio… |
CVE-2023-25073 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2023-24481 | Medium | 6.3 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escala… |
CVE-2023-22848 | Medium | 5.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-22311 | Medium | 6.7 | 2024-02-14 | Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 may allow an authenticated user to potenti… |
CVE-2023-22293 | High | 8.2 | 2024-02-14 | Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2023-44283 | High | 7.8 | 2024-02-14 | In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identi… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2023-31346 | Medium | 6.0 | 2024-02-13 | Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. |
CVE-2023-20587 | High | 7.1 | 2024-02-13 | Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution. … |
CVE-2023-20579 | Medium | 6.0 | 2024-02-13 | Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulti… |
CVE-2024-24751 | Medium | 4.3 | 2024-02-13 | sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control c… |
CVE-2024-21401 | Critical | 9.8 | 2024-02-13 | Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability |
CVE-2024-21376 | Critical | 9.0 | 2024-02-13 | Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability |
CVE-2024-21364 | Critical | 9.3 | 2024-02-13 | Microsoft Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2024-20695 | Medium | 5.7 | 2024-02-13 | Skype for Business Information Disclosure Vulnerability |
CVE-2024-1439 | Medium | 6.5 | 2024-02-12 | Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with hig… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-25677 | High | 8.8 | 2024-02-09 | In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For exa… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-0965 | Medium | 5.3 | 2024-02-08 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the RE… |
CVE-2024-24824 | High | 8.8 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and insta… |
CVE-2024-24771 | High | 7.7 | 2024-02-07 | Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication… |
CVE-2024-23447 | Medium | 5.3 | 2024-02-07 | An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write an… |
CVE-2024-23446 | Medium | 6.5 | 2024-02-07 | An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when q… |
CVE-2023-32479 | Medium | 6.7 | 2024-02-06 | Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerabil… |
CVE-2023-43517 | High | 8.4 | 2024-02-06 | Memory corruption in Automotive Multimedia due to improper access control in HAB. |
CVE-2024-1092 | Medium | 4.3 | 2024-02-05 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modifi… |
CVE-2024-0969 | Medium | 5.3 | 2024-02-05 | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it… |
CVE-2024-0374 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0373 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0371 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0370 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0366 | Medium | 4.3 | 2024-02-05 | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via… |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2021-46903 | Medium | 6.5 | 2024-02-04 | An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete req… |
CVE-2023-44031 | High | 7.5 | 2024-02-03 | Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows attackers to arbitrarily save sensitive files in insecure… |
CVE-2023-38263 | Medium | 6.5 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID… |
CVE-2023-32333 | Medium | 6.5 | 2024-02-02 | IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls. IBM X-Force ID: 255073. |
CVE-2023-47867 | High | 8.8 | 2024-02-01 | MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compr… |
CVE-2024-1114 | Medium | 6.5 | 2024-01-31 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/… |
CVE-2024-24566 | Medium | 5.3 | 2024-01-31 | Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-prote… |
CVE-2024-21653 | Medium | 6.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and… |
CVE-2024-1011 | Medium | 4.3 | 2024-01-29 | A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delet… |
CVE-2024-0212 | High | 8.1 | 2024-01-29 | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to a… |
CVE-2024-20263 | Medium | 5.8 | 2024-01-26 | A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 35… |
CVE-2024-0810 | Medium | 4.3 | 2024-01-24 | Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension t… |