CWE-284 · Improper Access Control (page 64)
Page 64 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24028 | Critical | 9.8 | 2023-01-20 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. |
CVE-2020-22655 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-22339 | High | 7.5 | 2023-01-20 | Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction… |
CVE-2022-46890 | Medium | 4.3 | 2023-01-19 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by… |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2023-21860 | Medium | 6.3 | 2023-01-18 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported versions that are affected are 7.4.38 and prio… |
CVE-2023-21894 | High | 7.3 | 2023-01-18 | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Suppo… |
CVE-2023-21893 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to ex… |
CVE-2023-21857 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). Supported versions that are affected… |
CVE-2023-21855 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Supported versions that are aff… |
CVE-2023-21854 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported versions that are affected are 12.2.3-12… |
CVE-2023-21853 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Supported versions that are affected are 12… |
CVE-2023-21852 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Supported versions that are affected are 12.2.3-12.2.12… |
CVE-2023-21851 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2… |
CVE-2023-21850 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affecte… |
CVE-2023-21849 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2… |
CVE-2023-21846 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0… |
CVE-2023-21832 | High | 8.8 | 2023-01-18 | Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0… |
CVE-2023-21828 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported versio… |
CVE-2022-46331 | High | 7.5 | 2023-01-18 | An unauthorized user could possibly delete any file on the system. |
CVE-2022-43494 | High | 7.5 | 2023-01-18 | An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. |
CVE-2022-43977 | Critical | 9.8 | 2023-01-17 | An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks acces… |
CVE-2015-10057 | Medium | 4.6 | 2023-01-16 | A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-22600 | Critical | 10.0 | 2023-01-12 | InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Im… |
CVE-2023-22487 | High | 7.7 | 2023-01-11 | Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the… |
CVE-2023-21752 | High | 7.1 | 2023-01-10 | Windows Backup Service Elevation of Privilege Vulnerability |
CVE-2023-21750 | High | 7.1 | 2023-01-10 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-21742 | High | 8.8 | 2023-01-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-21531 | High | 7.0 | 2023-01-10 | Azure Service Fabric Container Elevation of Privilege Vulnerability |
CVE-2022-45166 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used… |
CVE-2022-45164 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created… |
CVE-2022-36443 | High | 7.8 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card)… |
CVE-2022-36442 | Medium | 5.5 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized appl… |
CVE-2022-36441 | High | 7.1 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applicati… |
CVE-2022-4711 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to… |
CVE-2022-4709 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to… |
CVE-2022-4708 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up t… |
CVE-2022-4705 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, a… |
CVE-2022-4704 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, a… |
CVE-2022-4703 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to… |
CVE-2022-4702 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to… |
CVE-2022-4700 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to… |
CVE-2023-22903 | Critical | 9.8 | 2023-01-10 | api/views/user.py in LibrePhotos before e19e539 has incorrect access control. |
CVE-2023-0017 | Critical | 9.4 | 2023-01-10 | An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an ope… |
CVE-2023-0012 | Medium | 6.4 | 2023-01-10 | In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicio… |
CVE-2023-22473 | Low | 2.1 | 2023-01-09 | Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud… |
CVE-2022-23508 | High | 8.8 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i… |
CVE-2014-125054 | Medium | 4.3 | 2023-01-07 | A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulat… |
CVE-2022-47543 | Medium | 5.3 | 2023-01-05 | An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects. |
CVE-2021-4300 | Medium | 6.3 | 2023-01-04 | A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the… |
CVE-2022-47634 | High | 8.1 | 2023-01-01 | M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain H… |
CVE-2022-34672 | High | 7.8 | 2022-12-30 | NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the softwar… |
CVE-2022-4814 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4810 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4807 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-45778 | Critical | 9.8 | 2022-12-27 | https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in… |
CVE-2022-45431 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sendi… |
CVE-2022-45430 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sen… |
CVE-2022-4724 | Critical | 9.8 | 2022-12-27 | Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-44014 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks… |
CVE-2022-44565 | Medium | 5.3 | 2022-12-23 | An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a… |
CVE-2022-4689 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4684 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-23513 | Medium | 5.3 | 2022-12-23 | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor w… |
CVE-2022-41654 | Medium | 4.3 | 2022-12-22 | An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request ca… |
CVE-2022-3186 | High | 8.6 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main manage… |
CVE-2022-38655 | Medium | 6.4 | 2022-12-21 | BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES S… |
CVE-2022-38546 | Medium | 5.3 | 2022-12-21 | A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS s… |
CVE-2022-44643 | Medium | 5.7 | 2022-12-20 | A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy… |
CVE-2022-28173 | Critical | 9.1 | 2022-12-19 | The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker c… |
CVE-2022-4567 | High | 8.1 | 2022-12-17 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-31708 | Medium | 4.9 | 2022-12-16 | vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity rang… |
CVE-2022-25627 | Medium | 6.7 | 2022-12-16 | An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Man… |
CVE-2022-42865 | Medium | 5.5 | 2022-12-15 | This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may… |
CVE-2022-42862 | Medium | 5.5 | 2022-12-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Pri… |
CVE-2022-42861 | High | 8.8 | 2022-12-15 | This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-42859 | Medium | 5.5 | 2022-12-15 | Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be… |
CVE-2022-42853 | Medium | 5.5 | 2022-12-15 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the… |
CVE-2022-32945 | Medium | 4.3 | 2022-12-15 | An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record a… |
CVE-2022-47407 | Medium | 6.5 | 2022-12-14 | An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a… |
CVE-2022-38355 | High | 7.5 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose… |
CVE-2022-46664 | High | 8.1 | 2022-12-13 | A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4), Mendix Workflow C… |
CVE-2022-46354 | Medium | 5.3 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-45937 | High | 8.8 | 2022-12-13 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2022-45936 | High | 8.1 | 2022-12-13 | A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle access control for som… |
CVE-2022-41261 | Medium | 6.0 | 2022-12-12 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can… |
CVE-2022-23485 | Medium | 6.4 | 2022-12-10 | Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invit… |
CVE-2022-44932 | High | 7.5 | 2022-12-08 | An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service. |
CVE-2022-39915 | Low | 3.3 | 2022-12-08 | Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), a… |
CVE-2022-39910 | Low | 3.9 | 2022-12-08 | Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of a… |
CVE-2022-39906 | Low | 2.3 | 2022-12-08 | Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information. |
CVE-2022-39900 | Medium | 4.6 | 2022-12-08 | Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the… |
CVE-2022-39898 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. |
CVE-2022-39896 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. |
CVE-2022-39895 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit inte… |
CVE-2022-39894 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via imp… |
CVE-2022-37918 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37917 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37916 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |