Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,446 results · Clear filters · Feed
-
Medium 5.3
A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability i…
-
Medium 4.3
A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical…
-
Medium 5.3
EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insuffici…
-
Medium 5.3CVE-2025-51529 Public exploit
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin t…
-
Medium 6.3
Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted upload
A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate …
-
Medium 5.3
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Bypass Vulnerability
A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker t…
-
Medium 6.3
linlinjava litemall Endpoint AdminStorageController.java create unrestricted upload
A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipul…
-
Medium 5.3
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to …
-
Medium 6.5
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, wh…
-
Medium 6.8
INSTAR 2K+/4K UART improper physical access control
A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical devic…
-
Medium 5.8
Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform…
-
Medium 6.5
Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before…
-
Medium 4.4
Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may a…
-
Medium 6.7
Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated use…
-
Medium 6.3
code-projects eBlog Site File Upload save-slider.php unrestricted upload
A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack…
-
Medium 6.3
zlt2000 microservices-platform FileController.java upload unrestricted upload
A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to u…
-
Medium 6.3
LitmusChaos Litmus login access control
A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The manipulation of the argument projectID leads to improper access controls. It is possible to initiate the…
-
Medium 6.3
Qiyuesuo Eelectronic Signature Platform Scheduled Task upload execute unrestricted upload
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument F…
-
Medium 6.3
linlinjava litemall upload unrestricted upload
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack r…
-
Medium 5.3
zlt2000 microservices-platform Spring Actuator Interface actuator information disclosure
A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /actuator of the component Spring Actuator Interface. The manipulation leads to information disclos…
-
Medium 6.5
OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing al…
-
Medium 4.3
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into S…
-
Medium 5.3
SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated acto…
-
Medium 6.5
-
Medium 5.3
4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.
-
Medium 6.5
Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high priv…
-
Medium 5.5
Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variab…
-
Medium 6.5
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters …
-
Medium 6.5
Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-l…
-
Medium 6.5
An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the…
-
Medium 6.3
Exrick xboot UploadController.java upload unrestricted upload
A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation…
-
Medium 5.3
Exrick xboot Spring Boot Admin/Spring Actuator information disclosure
A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the att…
-
Medium 6.3
code-projects Kitchen Treasure userregistration.php unrestricted upload
A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate…
-
Medium 4.7
Campcodes Online Hotel Reservation System edit_room.php unrestricted upload
A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_room.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initi…
-
Medium 6.3
openviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted upload
A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename…
-
Medium 5.4CVE-2025-29557 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where use…
-
Medium 4.3
GLPI's incomprehensive permission checks can lead to data removal from allowed users
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific reso…
-
Medium 6.5
GLPI exposes data to non-allowed users
GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma…
-
Medium 4.7
299Ko CMS File Management view unrestricted upload
A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component File Management. The manipulation leads to unrestricted upload. It is possible to initiate the attack r…