Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
350 results · Clear filters · Feed
-
Low 2.1
Zammad: Titles of knowledge base answers will be shown across all categories via the global search
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at timestamps from catego…
-
Low 2.7
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft a…
-
Low 3.2
Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restr…
-
Low 3.7
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLoca…
-
Low 3.8
FluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-o…
-
Low 2.7
Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users'…
-
Low 3.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 3.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 1.9
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that ar…
-
Low 3.3
cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manip…
-
Low 3.3
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when `cms.safe_mode` is enabled. The Laravel session st…
-
Low 2.3
Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure
A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack …
-
Low 3.7
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address…
-
Low 2.1
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive informatio…
-
Low 3.3
extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argumen…
-
Low 3.1
None None None No publicly available exploits are known.
-
Low 1.2
Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own …
-
Low 2.4
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with phys…
-
Low 3.7
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
Low 1.9
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.0
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.4
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 3.3
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 1.9
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 2.5
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 1.8
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 3.7
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 3.3
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppor…
-
Low 3.3
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …
-
Low 2.5
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.3
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.1
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.0
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.7
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Low 3.7
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported …
-
Low 2.6
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported …
-
Low 3.7
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.1
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.1
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.0
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …