Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,449 results · Clear filters · Feed
-
Medium 4.3
koroket RedditOnRails Vote access control
A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified…
-
Medium 5.3
An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
-
Medium 6.3
ghostlander Halcyon Block Verification main.cpp AddToBlockIndex access control
A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access co…
-
Medium 6.3
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able t…
-
Medium 5.3
An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0…
-
Medium 5.3
Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. …
-
Medium 5.7
Access policy with access to all tenants and using label selectors has more access
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the…
-
Medium 5.3
A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unau…
-
Medium 6.4
HCL BigFix WebUI is affected by a missing-permission-check vulnerability
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
-
Medium 4.9
vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this i…
-
Medium 6.7
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Man…
-
Medium 5.4
An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ve…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur…
-
Medium 5.5
This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 1…
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may …
-
Medium 5.5
Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS …
-
Medium 6.5
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
-
Medium 5.3
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All vers…
-
Medium 6.0
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a …
-
Medium 6.4
Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts whe…
-
Medium 4.0
Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some …
-
Medium 4.0
Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access con…
-
Medium 4.0
Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows…
-
Medium 4.6
Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access…
-
Medium 4.0
Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive informat…
-
Medium 5.9
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
-
Medium 4.1
An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2…
-
Medium 6.5
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. T…
-
Medium 5.3
WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability
Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.
-
Medium 4.3
WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability
Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.
-
Medium 6.5
WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability
Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
-
Medium 6.5
WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
-
Medium 6.5
Unauthorized modification in Karmasis Informatics Infraskope SIEM+
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.
-
Medium 6.2
Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Cons…
-
Medium 4.3
Missing permissions check in Liferay Portal
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via …
-
Medium 4.2
The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config u…
-
Medium 4.3
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local…
-
Medium 4.0
Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allow…
-
Medium 4.3
Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to…