Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 8.8
Improper Access Control in calcom/cal.com
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.
-
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
High 7.8
A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, l…
-
High 7.8
Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access control
A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation l…
-
High 7.3
SourceCodester Online Food Ordering System POST Request access control
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request Handler. The manipu…
-
High 7.5
IBM Aspera Faspex improper access controls
IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.
-
High 8.8
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low pe…
-
High 7.5
A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the adm…
-
High 8.4
Improper Validation of Array Index in Automotive Android OS
Memory corruption in Automotive Android OS due to improper validation of array index.
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
-
High 7.3CVE-2023-0963 Public exploit
SourceCodester Music Gallery Site POST Request Users.php access control
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The …
-
High 8.2
Moodle: possible to set the preferred "start page" of other users
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise res…
-
High 7.8
Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows
Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
-
High 7.8
In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypa…
-
High 8.8
An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main…
-
High 8.8
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
-
High 8.7
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
-
High 8.8
TimescaleDB has incorrect access control
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the tele…
-
High 8.7
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
High 8.4
Improper access control in Qualcomm IPC
Memory corruption due to improper access control in Qualcomm IPC.
-
High 7.6
An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring a…
-
High 7.4
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10;…
-
High 7.2
Rancher: Privilege escalation via promoted roles
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…
-
High 7.5
Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certa…
-
High 7.5
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
-
High 7.5
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…
-
High 7.5
Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticat…
-
High 7.3
Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default pa…
-
High 7.5
An unauthorized user could possibly delete any file on the system.
-
High 7.5
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
-
High 7.5
Component takeover in Oracle Data Provider for .NET
Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle …
-
High 7.3
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (comp…
-
High 7.5
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite)…
-
High 7.5
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported ve…
-
High 7.5
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Suppo…
-
High 7.5
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(Pock…
-
High 7.5
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collection…
-
High 7.5
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Supported versio…
-
High 7.5
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…
-
High 7.5
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported vers…