Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

Architecture and Design, Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

3,216 results · Clear filters · Feed

High 8.8

CVE-2023-21846

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions …

Oracle BI Publisher (formerly XML Publisher)

Jan 17, 2023
High 8.8

CVE-2023-21832

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions …

Oracle BI Publisher (formerly XML Publisher)

Jan 17, 2023
High 8.1

CVE-2023-21828

Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (compo…

Oracle Hospitality Reporting and Analytics

Jan 17, 2023
High 7.7

CVE-2023-22487

Post mentions can be used to read any post on the forum without access control

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter…

flarum framework flarum/mentions Packagist

Jan 11, 2023
High 7.1

CVE-2023-21752 Public exploit

Windows Backup Service Elevation of Privilege Vulnerability

Windows Backup Service Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 1607 Windows

Jan 10, 2023
High 7.0

CVE-2023-21531

Azure Service Fabric Container Elevation of Privilege Vulnerability

Azure Service Fabric Container Elevation of Privilege Vulnerability

Microsoft Azure Service Fabric 9.0 for Linux Azure Service Fabric 8.2 Azure Service Fabric 9.1 Linux

Jan 10, 2023
High 8.8

CVE-2023-21742 Public exploit EPSS 56%

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

Jan 10, 2023
High 7.1

CVE-2023-21750

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 10, 2023
High 7.1

CVE-2022-36441

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used t…

Jan 10, 2023
High 7.8

CVE-2022-36443

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some commun…

Jan 10, 2023
High 8.9

CVE-2022-23508

GitOps Run allows for Kubernetes workload injection

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps ru…

weaveworks weave-gitops github.com/weaveworks/weave-gitops Go

Jan 9, 2023
High 8.1

CVE-2022-47634

M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access a…

Jan 1, 2023
High 7.8

CVE-2022-34672

NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user ca…

NVIDIA vGPU software (guest driver) - Windows, NVIDIA Cloud Gaming (guest driver) Windows

Dec 30, 2022
High 8.2

CVE-2022-4806

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 28, 2022
High 8.3

CVE-2022-4809

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 28, 2022
High 8.1

CVE-2022-4803

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 28, 2022
High 8.2

CVE-2022-4807

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 28, 2022
High 8.6

CVE-2022-4814

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

usememos usememos/memos github.com/usememos/memos Go

Dec 28, 2022
High 7.5

CVE-2022-45431

Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the …

Dec 27, 2022
High 8.4

CVE-2022-4724

Improper Access Control in ikus060/rdiffweb

Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.

ikus060 ikus060/rdiffweb rdiffweb PyPI

Dec 23, 2022
High 7.6

CVE-2022-4684

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

usememos usememos/memos github.com/usememos/memos Go

Dec 23, 2022
High 8.3

CVE-2022-4689

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

usememos usememos/memos github.com/usememos/memos Go

Dec 23, 2022
High 8.6

CVE-2022-3186

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an att…

Dataprobe iBoot-PDU FW

Dec 21, 2022
High 8.1

CVE-2022-4567

Improper Access Control in openemr/openemr

Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.

Open-Emr openemr/openemr

Dec 17, 2022
High 8.8

CVE-2022-42861

This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, …

Apple macOS macOS

Dec 15, 2022
High 7.5

CVE-2022-38355

Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to th…

Daikin SVMPC2 SVMPC1

Dec 13, 2022
High 8.1

CVE-2022-46664

A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (A…

Siemens Mendix Workflow Commons Mendix Workflow Commons V2.3 Mendix Workflow Commons V2.1 ICS / OT

Dec 13, 2022
High 8.1

CVE-2022-45936

A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module …

Siemens Mendix Email Connector ICS / OT

Dec 13, 2022
High 8.8

CVE-2022-45937

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…

Siemens TALON TC Modular (BACnet) APOGEE PXC Compact (BACnet) APOGEE PXC Modular (BACnet) ICS / OT

Dec 13, 2022
High 7.5

CVE-2022-44932

An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.

Dec 8, 2022
High 8.1

CVE-2022-37918

Broken Access Control for some Web-based Management URLs in AirWave Management Platform

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…

Dec 8, 2022
High 8.1

CVE-2022-37917

Broken Access Control for some Web-based Management URLs in AirWave Management Platform

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…

Dec 8, 2022
High 8.1

CVE-2022-37916

Broken Access Control for some Web-based Management URLs in AirWave Management Platform

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…

Dec 8, 2022
High 7.7

CVE-2022-35843

An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.…

Fortinet FortiOS FortiProxy Network devices

Dec 6, 2022
High 7.4

CVE-2022-44211

In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.

Dec 1, 2022
High 7.3

CVE-2022-4229

SourceCodester Book Store Management System index.php access control

A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_ci/index.php. The manipulation leads to improper access controls. The attack can be initiated remote…

SourceCodester Book Store Management System

Nov 30, 2022
High 8.8

CVE-2022-44037

An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, …

Nov 29, 2022
High 8.8

CVE-2022-34827

Carel Boss Mini 1.5.0 has Improper Access Control.

Nov 18, 2022
High 8.6

CVE-2022-24036

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.

Karmasis Informatics Infraskope SIEM+

Nov 16, 2022
High 7.5

CVE-2022-35276

Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allo…

Nov 11, 2022