Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.3
Microsoft System Center Elevation of Privilege Vulnerability
Microsoft System Center Elevation of Privilege Vulnerability
-
High 7.8
Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged at…
-
High 7.3
code-projects Online Notice Board Profile Picture registration.php unrestricted upload
A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads …
-
High 7.8
Improper Access Control in Core.
QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.
-
High 8.8
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerab…
-
High 7.5
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able …
-
High 8.2
Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to poten…
-
High 7.3
Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially en…
-
High 7.5
Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potential…
-
High 7.1
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Windows Update Stack Elevation of Privilege Vulnerability
-
High 7.1
Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop
Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php`…
-
High 8.7
User data deletion by anoynmous users in Zope
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed…
-
High 8.1CVE-2024-48955 Public exploit
Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the funct…
-
High 7.8
Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that …
-
High 7.4
Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to c…
-
High 7.5
Imagine Cup site Information Disclosure Vulnerability
Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.
-
High 7.6
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions …
-
High 8.1
Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or sys…
-
High 7.8
Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
-
High 7.8
Microsoft SharePoint Elevation of Privilege Vulnerability
Microsoft SharePoint Elevation of Privilege Vulnerability
-
High 8.2
Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow …
-
High 7.0
Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access …
-
High 7.0
Improper access control in Linux Workbooth Distro
Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script.
-
High 7.2
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Admin…
-
High 7.5
eLabFTW contains a direct and indirect information disclosure
eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something dis…
-
High 8.1
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthe…
-
High 8.8
PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak …
-
High 8.1
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is creat…
-
High 8.8
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user…
-
High 7.5
An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access …
-
High 8.4
In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an upda…
-
High 7.6
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, includin…
-
High 7.6
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values …
-
High 7.5
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthentica…
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.0
Improper Access Control in UI upgrade process
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or …
-
High 7.5
Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable…
-
High 8.8
The SYSCOM Group OMFLOW - Broken Access Control
OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining con…
-
High 7.3
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to…