CWE-284 · Improper Access Control (page 62)
Page 62 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3306 | High | 7.3 | 2023-06-18 | A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df… |
CVE-2023-3305 | High | 7.3 | 2023-06-18 | A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin… |
CVE-2023-28810 | Medium | 4.3 | 2023-06-15 | Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network confi… |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-32009 | High | 8.8 | 2023-06-14 | Windows Collaborative Translation Framework Elevation of Privilege Vulnerability |
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2022-39946 | High | 7.6 | 2023-06-13 | An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8… |
CVE-2023-2159 | Medium | 5.3 | 2023-06-09 | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass… |
CVE-2021-4380 | Critical | 9.8 | 2023-06-07 | The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_reques… |
CVE-2021-4364 | Medium | 4.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedul… |
CVE-2021-4361 | High | 8.8 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_setti… |
CVE-2021-4360 | Critical | 9.9 | 2023-06-07 | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting acce… |
CVE-2021-4352 | Medium | 5.3 | 2023-06-07 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in ver… |
CVE-2021-4338 | Medium | 6.4 | 2023-06-07 | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in ve… |
CVE-2020-36721 | Medium | 6.5 | 2023-06-07 | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the… |
CVE-2020-36700 | High | 8.8 | 2023-06-07 | The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security no… |
CVE-2020-36699 | Medium | 4.3 | 2023-06-07 | The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax a… |
CVE-2023-2183 | Medium | 4.1 | 2023-06-06 | Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having… |
CVE-2023-21670 | High | 7.8 | 2023-06-06 | Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode. |
CVE-2022-40529 | High | 7.1 | 2023-06-06 | Memory corruption due to improper access control in kernel while processing a mapping request from root process. |
CVE-2023-3099 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the li… |
CVE-2023-3096 | Medium | 5.3 | 2023-06-05 | A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedS… |
CVE-2023-3095 | Medium | 6.5 | 2023-06-04 | Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-28066 | High | 7.3 | 2023-06-01 | Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could… |
CVE-2023-3018 | Medium | 6.3 | 2023-05-31 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2023-2940 | Medium | 6.5 | 2023-05-30 | Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-2979 | Medium | 4.7 | 2023-05-30 | A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The m… |
CVE-2023-33191 | Medium | 4.6 | 2023-05-30 | Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyv… |
CVE-2023-2946 | High | 8.1 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2944 | Medium | 5.4 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2903 | Medium | 4.3 | 2023-05-25 | A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/R… |
CVE-2023-2902 | Medium | 4.3 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2023-2901 | Medium | 4.3 | 2023-05-25 | A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2021-25749 | High | 7.8 | 2023-05-24 | Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true. |
CVE-2023-33947 | Low | 2.7 | 2023-05-24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in se… |
CVE-2023-33946 | Low | 2.7 | 2023-05-24 | The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instance… |
CVE-2023-2845 | High | 8.1 | 2023-05-23 | Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0. |
CVE-2023-23446 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-23445 | High | 7.5 | 2023-05-15 | Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remo… |
CVE-2023-31199 | High | 7.7 | 2023-05-12 | Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of priv… |
CVE-2023-30768 | High | 7.7 | 2023-05-12 | Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a priv… |
CVE-2023-29242 | Medium | 6.7 | 2023-05-12 | Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2023-2674 | Medium | 4.3 | 2023-05-12 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2670 | Medium | 6.3 | 2023-05-12 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2023-1834 | Critical | 9.4 | 2023-05-11 | Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP… |
CVE-2023-0858 | Low | 3.1 | 2023-05-11 | Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2023-25771 | Medium | 5.8 | 2023-05-10 | Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-23573 | Medium | 4.4 | 2023-05-10 | Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure… |
CVE-2023-22312 | High | 7.2 | 2023-05-10 | Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-46279 | Medium | 5.0 | 2023-05-10 | Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable… |
CVE-2022-42465 | High | 7.2 | 2023-05-10 | Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileged user to potentially enable escalation… |
CVE-2022-41784 | High | 8.8 | 2023-05-10 | Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authenticated user to potentially enable escala… |
CVE-2022-41769 | Medium | 4.8 | 2023-05-10 | Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of p… |
CVE-2022-41690 | High | 7.1 | 2023-05-10 | Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authenticated user to potentially enable escalatio… |
CVE-2022-41621 | Low | 3.3 | 2023-05-10 | Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable information disclos… |
CVE-2022-40972 | Medium | 6.7 | 2023-05-10 | Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-40207 | High | 8.2 | 2023-05-10 | Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-32582 | Medium | 5.3 | 2023-05-10 | Improper access control in firmware for some Intel(R) NUC Boards, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Pro Comput… |
CVE-2022-32578 | Medium | 6.7 | 2023-05-10 | Improper access control for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-24905 | High | 7.8 | 2023-05-09 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2023-32060 | Medium | 6.5 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13… |
CVE-2023-31138 | High | 7.1 | 2023-05-09 | DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1… |
CVE-2023-21495 | Medium | 4.0 | 2023-05-04 | Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set. |
CVE-2023-21493 | Medium | 6.8 | 2023-05-04 | Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21491 | High | 8.5 | 2023-05-04 | Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege. |
CVE-2023-21490 | Medium | 4.7 | 2023-05-04 | Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager. |
CVE-2023-21488 | Medium | 4.4 | 2023-05-04 | Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips. |
CVE-2023-28070 | Medium | 6.7 | 2023-05-03 | Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A local malicious user could potentially… |
CVE-2023-21642 | High | 8.4 | 2023-05-02 | Memory corruption in HAB Memory management due to broad system privileges via physical address. |
CVE-2023-2429 | Critical | 9.8 | 2023-04-30 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-25496 | High | 7.8 | 2023-04-28 | A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevate… |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2021-45111 | High | 8.1 | 2023-04-25 | Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of de… |
CVE-2021-44465 | Medium | 4.3 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future n… |
CVE-2021-44460 | Medium | 6.5 | 2023-04-25 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system wit… |
CVE-2021-23203 | High | 7.5 | 2023-04-25 | Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF… |
CVE-2021-23178 | High | 7.5 | 2023-04-25 | Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized p… |
CVE-2021-23176 | Medium | 6.5 | 2023-04-25 | Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authent… |
CVE-2023-29924 | Critical | 9.8 | 2023-04-21 | PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. |
CVE-2023-2202 | Medium | 6.5 | 2023-04-21 | Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. |
CVE-2023-27350 | Critical | 9.8 | 2023-04-20 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir… |
CVE-2023-2112 | Low | 3.6 | 2023-04-20 | Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. |
CVE-2023-29922 | Medium | 5.3 | 2023-04-19 | PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. |
CVE-2023-29586 | Medium | 5.5 | 2023-04-19 | Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowin… |
CVE-2023-29921 | Medium | 5.3 | 2023-04-19 | PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. |
CVE-2023-29513 | Medium | 5.0 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible… |
CVE-2023-21985 | High | 7.7 | 2023-04-18 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Easily exploitable vu… |
CVE-2023-21980 | High | 7.1 | 2023-04-18 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32… |
CVE-2023-21969 | Medium | 6.7 | 2023-04-18 | Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1.0. Easily exploitable vulnerability al… |
CVE-2023-21968 | Low | 3.7 | 2023-04-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected… |
CVE-2023-21923 | High | 8.3 | 2023-04-18 | Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are… |
CVE-2023-21922 | Medium | 6.8 | 2023-04-18 | Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are… |
CVE-2023-21905 | Medium | 6.1 | 2023-04-18 | Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub). Supported versions… |
CVE-2023-30539 | Medium | 6.5 | 2023-04-17 | Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to… |
CVE-2023-2104 | Medium | 5.4 | 2023-04-15 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-26408 | High | 7.8 | 2023-04-12 | Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could res… |
CVE-2023-26406 | High | 7.8 | 2023-04-12 | Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could res… |
CVE-2023-28808 | Critical | 9.1 | 2023-04-11 | Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can expl… |
CVE-2023-28312 | Medium | 6.5 | 2023-04-11 | Azure Machine Learning Information Disclosure Vulnerability |
CVE-2023-28300 | High | 7.5 | 2023-04-11 | Azure Service Connector Security Feature Bypass Vulnerability |