CWE-284 · Improper Access Control (page 66)
Page 66 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3263 | High | 7.8 | 2022-09-23 | The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modi… |
CVE-2022-32848 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to capture a user’s scre… |
CVE-2022-32800 | Medium | 5.5 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may… |
CVE-2022-32789 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferences. |
CVE-2022-32783 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthorized access to Bluetooth. |
CVE-2022-32226 | Medium | 4.3 | 2022-09-23 | An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not typ… |
CVE-2022-35621 | Medium | 5.3 | 2022-09-21 | Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows r… |
CVE-2022-41235 | Medium | 5.3 | 2022-09-21 | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file s… |
CVE-2022-32883 | Medium | 5.5 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An ap… |
CVE-2022-32880 | Medium | 6.5 | 2022-09-20 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data. |
CVE-2022-32872 | Low | 2.4 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device… |
CVE-2022-0143 | Critical | 9.3 | 2022-09-19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to… |
CVE-2022-2995 | High | 7.1 | 2022-09-19 | Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an… |
CVE-2022-23768 | High | 8.8 | 2022-09-19 | This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks s… |
CVE-2022-28758 | High | 8.2 | 2022-09-16 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could o… |
CVE-2022-3182 | High | 7.0 | 2022-09-13 | Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the appl… |
CVE-2022-3027 | Medium | 5.7 | 2022-09-13 | The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name… |
CVE-2022-36385 | Medium | 6.8 | 2022-09-13 | A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device fu… |
CVE-2022-38466 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions… |
CVE-2022-36875 | Medium | 6.6 | 2022-09-09 | Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file withou… |
CVE-2022-36869 | Medium | 6.6 | 2022-09-09 | Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permissi… |
CVE-2022-36867 | Medium | 5.9 | 2022-09-09 | Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. |
CVE-2022-36866 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows… |
CVE-2022-36865 | Medium | 4.0 | 2022-09-09 | Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device i… |
CVE-2022-36864 | Medium | 4.0 | 2022-09-09 | Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged beh… |
CVE-2022-36856 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-20696 | High | 7.5 | 2022-09-08 | A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to th… |
CVE-2022-36088 | Medium | 5.0 | 2022-09-07 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permi… |
CVE-2022-21950 | Medium | 5.3 | 2022-09-07 | A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hi… |
CVE-2022-3065 | High | 7.5 | 2022-09-02 | Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2021-3864 | High | 7.0 | 2022-08-26 | A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that s… |
CVE-2022-32834 | Medium | 5.5 | 2022-08-24 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Cata… |
CVE-2021-4037 | Medium | 4.4 | 2022-08-24 | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-syst… |
CVE-2022-2792 | Medium | 6.6 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with… |
CVE-2022-36263 | High | 7.3 | 2022-08-19 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. |
CVE-2022-36024 | High | 7.5 | 2022-08-18 | py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the… |
CVE-2022-34259 | Medium | 5.3 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-34255 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-38184 | High | 7.5 | 2022-08-16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access… |
CVE-2022-28754 | High | 7.1 | 2022-08-11 | Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can joi… |
CVE-2022-28753 | High | 7.1 | 2022-08-11 | Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can joi… |
CVE-2022-36923 | High | 7.5 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 t… |
CVE-2022-20358 | Low | 3.3 | 2022-08-10 | In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. T… |
CVE-2022-33931 | Medium | 6.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no access to Alert Classification page cou… |
CVE-2022-33926 | High | 7.1 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an improper access control vulnerability. A remote malicious user could exploit this vulnerability in order… |
CVE-2022-33925 | Medium | 6.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An remote authenticated attacker could potentially exploit… |
CVE-2022-33924 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker with no access to create rules could potent… |
CVE-2021-46304 | High | 7.5 | 2022-08-10 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-802… |
CVE-2022-2702 | High | 7.3 | 2022-08-08 | A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file si… |
CVE-2022-27660 | High | 7.5 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network pa… |
CVE-2022-27185 | High | 7.5 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_master_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network pa… |
CVE-2022-27178 | Critical | 9.8 | 2022-08-05 | A denial of service vulnerability exists in the confctl_set_wan_cfg functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packe… |
CVE-2022-26346 | Critical | 9.8 | 2022-08-05 | A denial of service vulnerability exists in the ucloud_del_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet ca… |
CVE-2021-28511 | Medium | 5.8 | 2022-08-05 | This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the sec… |
CVE-2022-36832 | Medium | 4.0 | 2022-08-05 | Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage… |
CVE-2022-33731 | Medium | 5.1 | 2022-08-05 | Improper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and disable arbitrary components. |
CVE-2022-33720 | Low | 2.4 | 2022-08-05 | Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortc… |
CVE-2022-33714 | Medium | 6.2 | 2022-08-05 | Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile… |
CVE-2020-1754 | Medium | 4.3 | 2022-08-05 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewi… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-26308 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could cre… |
CVE-2022-2578 | Medium | 6.3 | 2022-07-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of… |
CVE-2016-4427 | High | 7.5 | 2022-07-28 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. |
CVE-2016-4426 | Medium | 4.3 | 2022-07-28 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. |
CVE-2021-38417 | High | 7.4 | 2022-07-27 | VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to fo… |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2022-31475 | Medium | 5.5 | 2022-07-21 | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-21586 | Medium | 6.4 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |
CVE-2022-1025 | High | 8.8 | 2022-07-12 | All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate thei… |
CVE-2022-33706 | Low | 2.4 | 2022-07-12 | Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture. |
CVE-2022-33701 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSleep method which is… |
CVE-2022-30752 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap cli… |
CVE-2022-30751 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap cli… |
CVE-2022-30750 | Low | 3.3 | 2022-07-12 | Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wi… |
CVE-2022-31257 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.1… |
CVE-2022-20859 | Medium | 6.5 | 2022-07-06 | A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence… |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-2088 | Medium | 6.8 | 2022-06-27 | An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0. |
CVE-2020-9754 | Medium | 5.3 | 2022-06-27 | NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. |
CVE-2022-2103 | Critical | 9.8 | 2022-06-24 | An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable… |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2017-20066 | Medium | 5.3 | 2022-06-20 | A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to imprope… |
CVE-2022-27511 | High | 8.1 | 2022-06-16 | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, a… |
CVE-2022-28612 | Medium | 5.4 | 2022-06-15 | Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in… |
CVE-2022-32158 | Critical | 9.0 | 2022-06-15 | Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the… |
CVE-2022-1958 | Medium | 6.3 | 2022-06-15 | A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to im… |
CVE-2022-32256 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-32255 | Medium | 5.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-31055 | High | 7.5 | 2022-06-13 | kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and al… |
CVE-2022-1659 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the i… |
CVE-2022-1658 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via t… |
CVE-2022-1656 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in li… |
CVE-2022-30745 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. |
CVE-2022-30715 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window. |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-1261 | Medium | 5.8 | 2022-05-26 | Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC se… |