Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,443 results · Clear filters · Feed
-
Medium 6.8
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported …
-
Medium 6.5
Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Depot Repair Diagnostics). Supp…
-
Medium 5.4
Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Suppo…
-
Medium 6.8
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-neo4j). Supported ver…
-
Medium 6.5
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
Medium 6.5
Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal …
-
Medium 6.5
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supporte…
-
Medium 5.3
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Suppo…
-
Medium 6.5
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Suppo…
-
Medium 6.8
Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Suppor…
-
Medium 6.4
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supp…
-
Medium 6.8
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions …
-
Medium 6.5
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File dow…
-
Medium 6.5
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Man…
-
Medium 6.5
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authen…
-
Medium 6.3
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execu…
-
Medium 6.3
WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. T…
-
Medium 6.3
SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File resul…
-
Medium 5.3
D-Link DIR-882 CGI Binary dllog.cgi main information disclosure
A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The expl…
-
Medium 6.3
SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unre…
-
Medium 6.3
PHPGurukul Hostel Management System checklogin.php access control
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia …
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be …
-
Medium 5.5
An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS S…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gat…
-
Medium 4.4
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Se…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, m…
-
Medium 4.4
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may bypass Gatekeepe…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
Medium 5.5
An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fi…
-
Medium 5.5
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app m…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, vision…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27…
-
Medium 5.1
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0
Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-to-menu routine invoked the com_menus item model's save() method directly. That model does not perform authorisation its…
-
Medium 5.3
Rizwan17 inventory-management-system dashboard.php access control
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access …
-
Medium 6.3
PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the…
-
Medium 6.3
PHPGurukul Bank Locker Management System sidebar.php access control
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. …
-
Medium 6.3
vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argu…