CWE-284 · Improper Access Control (page 68)
Page 68 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21291 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are… |
CVE-2021-34402 | Medium | 6.7 | 2022-01-18 | NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location… |
CVE-2021-34401 | High | 7.8 | 2022-01-18 | NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execu… |
CVE-2021-37864 | Low | 2.6 | 2022-01-18 | Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of arc… |
CVE-2021-28507 | Medium | 5.5 | 2022-01-14 | An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF mig… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2022-0170 | Medium | 4.3 | 2022-01-11 | peertube is vulnerable to Improper Access Control |
CVE-2021-45034 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2022-0133 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Improper Access Control |
CVE-2021-23173 | Low | 2.6 | 2022-01-10 | The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data. |
CVE-2021-4194 | Medium | 6.5 | 2022-01-06 | bookstack is vulnerable to Improper Access Control |
CVE-2021-22567 | Medium | 4.6 | 2022-01-05 | Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a cod… |
CVE-2021-25991 | Medium | 5.7 | 2021-12-29 | In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deac… |
CVE-2021-20050 | High | 7.5 | 2021-12-23 | An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially e… |
CVE-2021-42808 | Medium | 6.5 | 2021-12-20 | Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges. |
CVE-2021-4119 | Critical | 9.8 | 2021-12-15 | bookstack is vulnerable to Improper Access Control |
CVE-2021-36888 | Critical | 9.8 | 2021-12-15 | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPr… |
CVE-2021-24859 | Medium | 4.3 | 2021-12-13 | The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metada… |
CVE-2021-24845 | Medium | 6.5 | 2021-12-13 | The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary… |
CVE-2021-4089 | Medium | 4.3 | 2021-12-10 | snipe-it is vulnerable to Improper Access Control |
CVE-2021-22565 | Medium | 6.5 | 2021-12-09 | An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposur… |
CVE-2021-42124 | High | 8.8 | 2021-12-07 | An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session ta… |
CVE-2021-35245 | High | 8.4 | 2021-12-06 | When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. |
CVE-2021-26334 | Critical | 9.9 | 2021-12-01 | The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 c… |
CVE-2020-10627 | High | 7.3 | 2021-12-01 | Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured P… |
CVE-2021-3992 | Medium | 6.5 | 2021-12-01 | kimai2 is vulnerable to Improper Access Control |
CVE-2021-4026 | Medium | 4.3 | 2021-11-30 | bookstack is vulnerable to Improper Access Control |
CVE-2021-42116 | Medium | 4.3 | 2021-11-30 | Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote atta… |
CVE-2021-36917 | Medium | 6.5 | 2021-11-24 | WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used… |
CVE-2021-3554 | Critical | 9.0 | 2021-11-24 | Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attack… |
CVE-2021-40130 | Medium | 4.9 | 2021-11-19 | A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log file… |
CVE-2021-36909 | High | 8.8 | 2021-11-18 | Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire databas… |
CVE-2021-42360 | High | 7.6 | 2021-11-17 | On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level… |
CVE-2021-35528 | High | 7.2 | 2021-11-17 | Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Bill… |
CVE-2021-24853 | Medium | 4.3 | 2021-11-17 | The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action… |
CVE-2021-26338 | High | 7.5 | 2021-11-16 | Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potent… |
CVE-2021-3062 | High | 8.1 | 2021-11-10 | An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to t… |
CVE-2020-12488 | Medium | 5.5 | 2021-11-10 | The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permi… |
CVE-2021-24816 | Medium | 4.3 | 2021-11-08 | The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Au… |
CVE-2021-24801 | Medium | 4.3 | 2021-11-08 | The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them an… |
CVE-2021-24698 | Medium | 4.3 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, e… |
CVE-2021-42359 | High | 7.5 | 2021-11-05 | WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthe… |
CVE-2021-25501 | Medium | 5.7 | 2021-11-05 | An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some… |
CVE-2021-40113 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-40112 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-34795 | Critical | 10.0 | 2021-11-04 | Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ON… |
CVE-2021-39333 | High | 8.1 | 2021-11-01 | The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users fo… |
CVE-2021-24781 | Medium | 4.3 | 2021-11-01 | The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (… |
CVE-2021-41194 | Critical | 9.1 | 2021-10-28 | FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with Fi… |
CVE-2021-34794 | Medium | 5.3 | 2021-10-27 | A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software a… |
CVE-2021-34754 | Medium | 5.8 | 2021-10-27 | Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2021-34864 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-21703 | High | 7.8 | 2021-10-25 | In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as… |
CVE-2021-38457 | Critical | 9.8 | 2021-10-22 | The server permits communication without any authentication procedure, allowing the attacker to initiate a session with the server without providing any form o… |
CVE-2021-24752 | Medium | 5.7 | 2021-10-18 | Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users… |
CVE-2021-38454 | Critical | 10.0 | 2021-10-12 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files… |
CVE-2021-28129 | High | 7.8 | 2021-10-07 | While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500… |
CVE-2021-38392 | Medium | 6.5 | 2021-10-04 | A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could us… |
CVE-2021-3626 | High | 8.8 | 2021-10-01 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating sys… |
CVE-2021-41298 | High | 8.8 | 2021-09-30 | ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied… |
CVE-2020-12030 | Critical | 10.0 | 2021-09-29 | There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the… |
CVE-2021-20034 | Critical | 9.1 | 2021-09-27 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file po… |
CVE-2021-22941 | Critical | 9.8 | 2021-09-23 | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zo… |
CVE-2021-34724 | Medium | 6.0 | 2021-09-23 | A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the un… |
CVE-2021-34696 | Medium | 5.8 | 2021-09-23 | A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, r… |
CVE-2021-1625 | Medium | 5.8 | 2021-09-23 | A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent the Zone-Based Po… |
CVE-2021-1419 | High | 7.8 | 2021-09-23 | A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the af… |
CVE-2021-24635 | Medium | 5.4 | 2021-09-20 | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authentic… |
CVE-2021-24583 | Medium | 4.3 | 2021-09-20 | The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_po… |
CVE-2021-37183 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications… |
CVE-2021-25463 | Medium | 4.0 | 2021-09-09 | Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. |
CVE-2021-35213 | High | 8.9 | 2021-08-31 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to… |
CVE-2021-35221 | Medium | 6.3 | 2021-08-31 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-1591 | Medium | 5.8 | 2021-08-25 | A vulnerability in the EtherChannel port subscription logic of Cisco Nexus 9500 Series Switches could allow an unauthenticated, remote attacker to bypass acces… |
CVE-2021-1583 | Medium | 4.4 | 2021-08-25 | A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI)… |
CVE-2021-1581 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1580 | Medium | 6.5 | 2021-08-25 | Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote… |
CVE-2021-1577 | Critical | 9.1 | 2021-08-25 | A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (C… |
CVE-2021-25956 | Medium | 4.7 | 2021-08-17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate alrea… |
CVE-2021-1113 | Medium | 4.7 | 2021-08-11 | NVIDIA camera firmware contains a difficult to exploit vulnerability where a highly privileged attacker can cause unauthorized modification to camera resources… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2021-24500 | High | 8.1 | 2021-08-09 | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that… |
CVE-2021-32002 | Medium | 4.3 | 2021-08-05 | Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configu… |
CVE-2021-22920 | Medium | 6.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-25448 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. |
CVE-2021-25447 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview. |
CVE-2021-25446 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview. |
CVE-2021-1601 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-1600 | High | 8.3 | 2021-07-22 | Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an… |
CVE-2021-25320 | Critical | 9.9 | 2021-07-15 | A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credenti… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-25440 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated priv… |
CVE-2021-25439 | Low | 3.3 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25438 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25431 | Medium | 5.5 | 2021-07-08 | Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows untrusted application… |
CVE-2021-28809 | Critical | 9.8 | 2021-07-08 | An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to com… |
CVE-2021-32517 | High | 7.5 | 2021-07-07 | Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in d… |
CVE-2021-32514 | High | 7.5 | 2021-07-07 | Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the device. The referred vul… |
CVE-2021-34627 | Medium | 4.3 | 2021-07-07 | A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom ex… |