Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.2
An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all version…
-
High 8.1
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision c…
-
High 8.8
JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated…
-
High 8.8
Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attacke…
-
High 7.8
Improper Access control in GPU Subsystem
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
-
High 7.1
Improper access control in Kernel
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
-
High 7.3
Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. A local auth…
-
High 7.8
runAsNonRoot logic bypass for Windows containers
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
-
High 8.8
Improper Access Control in cloudexplorer-dev/cloudexplorer-lite
Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
-
High 7.5
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122…
-
High 7.5
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122…
-
High 7.1
Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user …
-
High 7.1
Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family wit…
-
High 8.8
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
High 7.2
Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileg…
-
High 8.2
Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potenti…
-
High 8.8
Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authent…
-
High 7.1
Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authentica…
-
High 7.2
Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalatio…
-
High 7.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
High 7.1
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…
-
High 8.5
Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write a…
-
High 8.4
Improper Access Control in HAB Memory Management
Memory corruption in HAB Memory management due to broad system privileges via physical address.
-
High 7.8
A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a…
-
High 7.5
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0,…
-
High 7.5
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to val…
-
High 7.4
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deact…
-
High 7.1
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authentic…
-
High 8.8
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (refer…
-
High 7.7
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affecte…
-
High 7.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…
-
High 8.3
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…
-
High 7.8
ZDI-CAN-20712: Net.HTTP.request URL restriction bypass
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…
-
High 7.8
ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass Vulnerability
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…
-
High 7.8
Windows Registry Elevation of Privilege Vulnerability
Windows Registry Elevation of Privilege Vulnerability
-
High 7.5
Azure Service Connector Security Feature Bypass Vulnerability
Azure Service Connector Security Feature Bypass Vulnerability
-
High 8.1
Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific …
-
High 7.8
Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attack…
-
High 7.5
The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration da…
-
High 8.8
Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privi…