Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.3
Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious …
-
High 7.3
Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local maliciou…
-
High 7.3
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. …
-
High 7.3
Fuji Electric Tellus Lite V-Simulator Improper Access Control
A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system.
-
High 8.5
Nextcloud Server users can make external storage mount points inaccessible for other users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 2…
-
High 7.5
CVE-2023-38205 issues | ColdFusion Admin Panel Access
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the admin…
-
High 7.3
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. …
-
High 8.4
Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification…
-
High 8.8
Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potenti…
-
High 8.4
Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potenti…
-
High 7.5
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.00…
-
High 7.8
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentia…
-
High 8.2
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.…
-
High 7.5
Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.…
-
High 7.5
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial o…
-
High 7.3
Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated u…
-
High 7.9
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions…
-
High 7.8
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonat…
-
High 8.1
Improper Access Control in mintplex-labs/anything-llm
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind …
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the re…
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive information.
-
High 7.5
Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS…
-
High 8.2
Palantir Tiles missing authentication on API endpoints
The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
-
High 7.3
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an a…
-
High 8.3
MySQL Connectors takeover vulnerability
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to …
-
High 7.3
Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A…
-
High 8.8
A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108.…
-
High 7.8
Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
-
High 7.3
Azure DevOps Server Elevation of Privilege Vulnerability
Azure DevOps Server Elevation of Privilege Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.7
An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 thro…
-
High 8.2
Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary file…
-
High 8.1
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users…
-
High 8.8
ByDemes Group Airspace CCTV Web Service Improper Access Control
The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.
-
High 8.1
Improper Access Control in salesagility/suitecrm
Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.
-
High 8.4
Improper Access Control in Core
Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
-
High 8.7
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
-
High 7.8
Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-…