Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,449 results · Clear filters · Feed
-
Medium 5.3
Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control
A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. The…
-
Medium 6.5
SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control
A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to …
-
Medium 6.3CVE-2023-0916 Public exploit
SourceCodester Auto Dealer Management System Users.php access control
A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attac…
-
Medium 5.3
Adobe Connect Improper Access Control Security feature bypass
Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature…
-
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
Medium 5.5
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
-
Medium 6.5
CVE-2023-22805
LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device.
-
Medium 5.9
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Application…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 6.8
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin c…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disabl…
-
Medium 5.3
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Regist…
-
Medium 5.4
Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without …
-
Medium 5.5
Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(1…
-
Medium 4.0
Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access inf…
-
Medium 4.0
Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.…
-
Medium 5.3
Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a sp…
-
Medium 5.8
Document content of files can be obtained through Collabora for files of other users
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora…
-
Medium 5.3
Malicious users in Discourse can create spam topics as any user due to improper access control
Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a wo…
-
Medium 6.5
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
-
Medium 6.5
Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials t…
-
Medium 6.5
An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing p…
-
Medium 4.3
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userI…
-
Medium 4.3
Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is…
-
Medium 6.3
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported version…
-
Medium 4.6
Little Apps Little Software Stats Password Reset class.securelogin.php access control
A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads …
-
Medium 5.3
Apache Superset: Dashboard metadata information leak
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prio…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level per…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level perm…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level …
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 5.4
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 4.3
Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level p…
-
Medium 6.4
Local Privilege Escalation in SAP Host Agent (Windows)
In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SA…
-
Medium 5.5
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is …
-
Medium 6.5
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of u…
-
Medium 4.3
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic use…