Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 8.1
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions…
-
High 8.0
Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows…
-
High 7.5
A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of Aut…
-
High 7.8
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protection…
-
High 7.8
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protection…
-
High 8.3
OpenCTI Authenticated Privilege Escalation
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain a…
-
High 7.4
IBM Performance Tools for i privilege escalation
IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 284563.
-
High 8.8
An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execu…
-
High 8.8
iommufd: Fix missing update of domains_itree after splitting iopt_area
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to …
-
High 7.5
Improper permission control in com.transsion.videocallenhancer
The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.
-
High 7.2
Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware…
-
High 8.4
Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware…
-
High 7.3
Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user …
-
High 7.8
Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authentic…
-
High 7.0
Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user…
-
High 8.8
Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to p…
-
High 8.8
Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user t…
-
High 7.8
ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 2 of 2
Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…
-
High 8.8
An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to b…
-
High 7.8
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error…
-
High 7.5
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of …
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
-
High 8.4
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted comman…
-
High 7.5CVE-2024-31964 Public exploit
A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…
-
High 7.6
NGDIN_ST v2.0D.0062 - Multiple Vulnerabilities
Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit (RTU), by DPS Telecom. Attackers can exploit those security vulnerabilities to perform critical actions such as escalate user's privilege, steal us…
-
High 7.5
Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases h…
-
High 7.8
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijack…
-
High 8.6
An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time account…
-
High 7.3
A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS S…
-
High 8.0
Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be a…
-
High 8.8
Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property t…
-
High 8.4
An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufa…
-
High 8.2
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) …
-
High 7.5
An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access…
-
High 8.3
A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Re…
-
High 8.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.3
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…