Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,444 results · Clear filters · Feed
-
Medium 5.3
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…
-
Medium 5.3
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Nex…
-
Medium 5.9
Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u49…
-
Medium 4.3
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mo…
-
Medium 5.8
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21…
-
Medium 4.6
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Se…
-
Medium 4.4
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions t…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.1
Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). Th…
-
Medium 4.3
Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mob…
-
Medium 6.3
zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload
A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulati…
-
Medium 4.3
Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate its permissions and bypa…
-
Medium 4.7
SolarWinds Serv-U Broken Access Control Vulnerability
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower i…
-
Medium 4.7
SolarWinds Serv-U Privilege Escalation Vulnerability
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
-
Medium 4.7
SolarWinds Serv-U Privilege Escalation Vulnerability
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
-
Medium 4.7
SolarWinds Serv-U Remote Code Execution Vulnerability
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
-
Medium 5.3
PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCom…
-
Medium 4.7
SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carr…
-
Medium 5.3
zevorn rt-claw http_request net.c claw_net_post information disclosure
A vulnerability was found in zevorn rt-claw up to 0.2.0. Affected is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation results in information disclosure. The attack can be executed re…
-
Medium 4.9
Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through …
-
Medium 4.4
Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a lo…
-
Medium 6.5
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows …
-
Medium 4.3
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet …
-
Medium 6.3
HCL DFXServer is affected by a Missing Access Control vulnerability
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the…
-
Medium 5.8
Anubis: Policy bypass via client controlled X-Original-URI header
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header befor…
-
Medium 5.5
Windows Kernel Security Feature Bypass Vulnerability
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
-
Medium 5.4
Microsoft SharePoint Server Spoofing Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
-
Medium 6.1
DNS Client Tampering Vulnerability
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
-
Medium 5.1
Windows System Secure Feature Bypass Vulnerability
Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.
-
Medium 4.3
nextlevelbuilder GoClaw tool.go handleNavigate information disclosure
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack…
-
Medium 6.5
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Se…
-
Medium 4.7
SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload
A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The …
-
Medium 5.3
WuzhiCMS Attachment API index.php listimage information disclosure
A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to information disclosure. T…
-
Medium 4.7
AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulati…
-
Medium 5.3
QILING Disk Master Kernel Driver diskbckp.sys access control
A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack can only be perfo…
-
Medium 5.3
MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control
A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The attack can only be exe…
-
Medium 6.5
Capgo - Channel Configuration Mutation via Write-Scoped API Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with…
-
Medium 6.5
Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are …
-
Medium 4.3
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure
A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. Th…
-
Medium 6.3
manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control
A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard E…