Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.3
Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCISe…
-
High 7.3
code-projects Student Crud Operation Add Student Page/Edit Student add.php move_uploaded_file unrestricted upload
A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of the component Add Student Page/Edit Student Page. Performing manipulation results in unrestricted up…
-
High 7.3
Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload
A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file uploadWxFile.do. The manipulation of the argument File results in unrestricted upload. The attack may…
-
High 8.1
phpMyFAQ duplicate email registration allows multiple accounts with the same email
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often u…
-
High 8.4
DX UIM Probe Improper ACL Handling RCE
DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
-
High 7.5
FreshRSS: Unauthenticated users can view default user's information
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoint…
-
High 8.6
FlagForgeCTF Unauthenticated Resource Modification/Deletion
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create,…
-
High 8.7
Unrestricted FTP Access Vulnerability in Syrotech Router
This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vulnerability by establishing an FTP connection using default credentials, potentially gaining unautho…
-
High 7.5
An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in so…
-
High 7.5
Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowin…
-
High 7.5
Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the…
-
High 7.7
Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service…
-
High 7.5
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corr…
-
High 7.3
SourceCodester Online Exam Form Submission register.php unrestricted upload
A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the argument img causes unrestricted upload. It is possible to initiate the attack remotely. The exploit …
-
High 7.5
Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
-
High 8.1
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distri…
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to …
-
High 7.5
The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to overri…
-
High 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be ab…
-
High 7.1
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write fil…
-
High 8.2
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its …
-
High 7.8
MongoDB Windows installation MSI may leave ACLs unset on custom installation directories
The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB…
-
High 7.3
Campcodes Online Job Finder System applicationform.php unrestricted upload
A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The manipulation of the argument picture results in unrestricted upload. It is possible to launch the at…
-
High 7.3
1000projects Online Student Project Report Submission and Evaluation System student_controller.php unrestricted upload
A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/student_controller.php. Such manipulation of the argument new_image le…
-
High 7.3
1000projects Online Student Project Report Submission and Evaluation System faculty_controller.php unrestricted upload
A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty_controller.php. This manipulation of the argument new_image ca…
-
High 8.1
SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows…
-
High 7.3
eCharge Hardy Barth Salia PLCC api.php unrestricted upload
A security flaw has been discovered in eCharge Hardy Barth Salia PLCC up to 2.3.81. This issue affects some unknown processing of the file /api.php. The manipulation of the argument setrfidlist results in unrestricted upload. The attack may be performed from …
-
High 7.5
OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK …
-
High 7.5
Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download…
-
High 8.8
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a rem…
-
High 7.5
An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary comm…
-
High 7.5
An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the…
-
High 7.3
Windows MultiPoint Services Elevation of Privilege Vulnerability
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 7.3
SiempreCMS file_upload.php unrestricted upload
A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available a…
-
High 7.5
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
-
High 7.5
The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover…
-
High 7.3
RemoteClinic edit-my-profile.php unrestricted upload
A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument image results in unrestricted upload. The attack may be launched remotely. The exploit has been made …
-
High 7.3
RemoteClinic edit.php unrestricted upload
A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of the argument image results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and…