CWE-284 · Improper Access Control (page 63)
Page 63 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28246 | High | 7.8 | 2023-04-11 | Windows Registry Elevation of Privilege Vulnerability |
CVE-2023-24544 | High | 8.1 | 2023-04-11 | Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the p… |
CVE-2023-23575 | Medium | 4.3 | 2023-04-11 | Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network… |
CVE-2023-28051 | High | 7.8 | 2023-04-07 | Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attacker could potentially exploit this vulne… |
CVE-2023-0319 | Medium | 5.8 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions sta… |
CVE-2023-1883 | Medium | 5.4 | 2023-04-05 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-28845 | Low | 3.5 | 2023-03-31 | Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member l… |
CVE-2023-28844 | Medium | 5.7 | 2023-03-31 | Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older… |
CVE-2023-28645 | Medium | 5.7 | 2023-03-31 | Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app… |
CVE-2023-29140 | Medium | 5.3 | 2023-03-31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been h… |
CVE-2023-28877 | High | 7.5 | 2023-03-31 | The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by t… |
CVE-2022-47542 | High | 8.8 | 2023-03-30 | Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges. |
CVE-2022-24972 | Medium | 6.5 | 2023-03-28 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.3… |
CVE-2023-22250 | Medium | 5.3 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Secur… |
CVE-2023-1138 | High | 7.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve… |
CVE-2023-1647 | High | 8.8 | 2023-03-27 | Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. |
CVE-2023-28443 | Medium | 4.2 | 2023-03-24 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly… |
CVE-2023-26360 | High | 8.6 | 2023-03-23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could resu… |
CVE-2023-20065 | High | 7.8 | 2023-03-23 | A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to r… |
CVE-2023-1557 | Medium | 6.3 | 2023-03-22 | A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2023-25595 | Medium | 5.5 | 2023-03-22 | A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive inf… |
CVE-2023-27578 | Critical | 9.1 | 2023-03-20 | Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insuffici… |
CVE-2023-1491 | Medium | 4.4 | 2023-03-18 | A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryp… |
CVE-2023-1490 | Medium | 4.4 | 2023-03-18 | A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDA… |
CVE-2023-1489 | High | 7.8 | 2023-03-18 | A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0… |
CVE-2023-1486 | Medium | 4.4 | 2023-03-18 | A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the… |
CVE-2023-1453 | Medium | 4.4 | 2023-03-17 | A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsd… |
CVE-2023-28531 | Critical | 9.8 | 2023-03-17 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. |
CVE-2023-21465 | Medium | 5.5 | 2023-03-16 | Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files. |
CVE-2023-21463 | Medium | 4.0 | 2023-03-16 | Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.03.0 in Android 13 a… |
CVE-2023-21457 | Medium | 4.1 | 2023-03-16 | Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission. |
CVE-2023-0811 | Critical | 9.1 | 2023-03-16 | Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE… |
CVE-2023-27875 | High | 7.5 | 2023-03-16 | IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. |
CVE-2023-1432 | High | 7.3 | 2023-03-16 | A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2023-24468 | Critical | 9.8 | 2023-03-15 | Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2 |
CVE-2023-27268 | Medium | 5.3 | 2023-03-14 | SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attac… |
CVE-2023-26460 | Medium | 5.3 | 2023-03-14 | Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that requi… |
CVE-2022-2259 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
CVE-2023-23911 | High | 7.5 | 2023-03-10 | An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the grou… |
CVE-2022-40539 | High | 8.4 | 2023-03-10 | Memory corruption in Automotive Android OS due to improper validation of array index. |
CVE-2022-4331 | Medium | 5.7 | 2023-03-09 | An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions… |
CVE-2023-27088 | High | 8.8 | 2023-03-08 | feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within t… |
CVE-2023-25605 | High | 7.5 | 2023-03-07 | A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unautho… |
CVE-2023-22335 | High | 7.5 | 2023-03-06 | Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to bypass acc… |
CVE-2022-40633 | Medium | 4.6 | 2023-03-02 | A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks. |
CVE-2023-26474 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text a… |
CVE-2023-26473 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored… |
CVE-2023-26471 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted m… |
CVE-2022-23240 | Medium | 6.5 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorize… |
CVE-2023-23508 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be ab… |
CVE-2022-32902 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be abl… |
CVE-2023-25821 | Medium | 5.7 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access… |
CVE-2023-1007 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd… |
CVE-2023-0998 | Medium | 6.5 | 2023-02-24 | A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alpha… |
CVE-2023-0963 | High | 7.3 | 2023-02-22 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users… |
CVE-2023-24320 | Critical | 9.8 | 2023-02-21 | An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors. |
CVE-2023-22920 | Critical | 9.8 | 2023-02-21 | A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended… |
CVE-2023-0916 | Medium | 6.3 | 2023-02-19 | A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-22232 | Medium | 5.3 | 2023-02-17 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feat… |
CVE-2023-23923 | High | 8.2 | 2023-02-17 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for a… |
CVE-2023-24485 | High | 7.8 | 2023-02-16 | Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace… |
CVE-2023-24484 | Medium | 5.5 | 2023-02-16 | A malicious user can cause log files to be written to a directory that they do not have permission to write to. |
CVE-2023-23752 | Medium | 5.3 | 2023-02-16 | An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. |
CVE-2022-38935 | High | 8.8 | 2023-02-15 | An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminCon… |
CVE-2023-22807 | Critical | 9.8 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could contro… |
CVE-2023-22805 | Medium | 6.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to re… |
CVE-2022-46892 | Critical | 9.8 | 2023-02-15 | In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex. |
CVE-2023-20927 | High | 7.8 | 2023-02-15 | In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation… |
CVE-2023-21777 | High | 8.7 | 2023-02-14 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2023-21717 | High | 8.8 | 2023-02-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-25149 | High | 8.8 | 2023-02-14 | TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleD… |
CVE-2023-23835 | Medium | 5.9 | 2023-02-14 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.2… |
CVE-2023-25161 | Low | 3.7 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2023-25159 | Low | 2.3 | 2023-02-13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the s… |
CVE-2023-0661 | Medium | 6.5 | 2023-02-12 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. |
CVE-2022-33243 | High | 8.4 | 2023-02-12 | Memory corruption due to improper access control in Qualcomm IPC. |
CVE-2022-46755 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for… |
CVE-2022-46754 | High | 8.7 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license fe… |
CVE-2022-46678 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy… |
CVE-2022-46677 | Medium | 6.8 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for… |
CVE-2022-46676 | Medium | 4.9 | 2023-02-11 | Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disable or delete users under administration… |
CVE-2023-24688 | Medium | 5.3 | 2023-02-09 | An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled. |
CVE-2023-21447 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privil… |
CVE-2023-21445 | Medium | 5.5 | 2023-02-09 | Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allo… |
CVE-2023-21442 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attack… |
CVE-2023-21438 | Low | 2.1 | 2023-02-09 | Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. |
CVE-2023-21427 | Medium | 5.4 | 2023-02-09 | Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. |
CVE-2022-30564 | Medium | 5.3 | 2023-02-09 | Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable… |
CVE-2022-47648 | High | 7.6 | 2023-02-08 | An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticati… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2023-0744 | Critical | 9.8 | 2023-02-08 | Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. |
CVE-2023-23615 | Medium | 5.3 | 2023-02-03 | Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or conte… |
CVE-2022-47699 | Critical | 9.8 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control. |
CVE-2023-24425 | Medium | 6.5 | 2023-01-26 | Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing… |
CVE-2023-24022 | Critical | 10.0 | 2023-01-26 | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered a… |
CVE-2023-0451 | High | 7.5 | 2023-01-26 | Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One… |
CVE-2022-40036 | Medium | 6.5 | 2023-01-26 | An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserLi… |
CVE-2022-31704 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an… |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2023-24058 | Medium | 4.3 | 2023-01-22 | Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2… |