Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 4.3CVE-2025-4901 EPSS 79%
D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosure
A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the file /H5/state_view.data of the component HTTP Endpoint. The manipulation leads to information discl…
-
Low 2.6
Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may r…
-
Medium 5.0
Nextcloud Desktop 3rdparty applications can create share links via socket API
Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easil…
-
Medium 5.9
Improper Access Control vulnerability in LIVE CONTRACT
An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUI…
-
Medium 6.3
feng_ha_ha/megagao ssm-erp/production_ssm PictureServiceImpl.java uploadPicture unrestricted upload
A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. It is …
-
Medium 5.3
D-Link DI-7003GV2 login.data information disclosure
A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the file /login.data. The manipulation leads to information disclosure. The attack may be launched remote…
-
Medium 5.3
D-Link DI-7003GV2 install_base.data information disclosure
A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /install_base.data. The manipulation leads to information disclosure. The attack can …
-
Medium 5.3
D-Link DI-7003GV2 index.data information disclosure
A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.data. The manipulation leads to information disclosure. It is possible to launch the attack remotely. …
-
Medium 5.3
D-Link DI-7003GV2 Configuration get_version.data information disclosure
A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of the file /H5/get_version.data of the component Configuration Handler. The manipulation leads to inform…
-
Medium 6.3
Campcodes Sales and Inventory System product.php unrestricted upload
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture leads to unrestricted up…
-
High 7.8CVE-2025-47161 Public exploit
Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
-
Critical 9.1
Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft …
-
Medium 6.7
Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allo…
-
High 7.3
Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 m…
-
Medium 5.3
Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.1…
-
Medium 5.9
Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allo…
-
Medium 4.3
Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthentica…
-
High 7.5
Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may …
-
Medium 5.0
Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthentica…
-
High 7.3
Improper access control for some Intel(R) Graphics software may allow an authenticated user to potentially enable denia…
-
Critical 9.1CVE-2025-43563 EPSS 17%
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data …
-
Medium 6.9
Server Identity Validation Bypass in Absolute Persistence®
A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to the device, and full hostile network control, to initiate OS commands on the device. To remediate this…
-
High 7.0
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may b…
-
High 7.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.…
-
Critical 9.1
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS …
-
Medium 6.3
The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.4. An app may be able to br…
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequ…
-
High 7.1
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS…
-
Medium 6.5CVE-2025-31258 Public exploit
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able…
-
Medium 6.3
kkFileView fileUpload unrestricted upload
A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The ex…
-
Medium 5.3
Gosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosure
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to in…
-
Medium 5.3
Gosuncn Technology Group Audio-Visual Integrated Management Platform Configuration File config.properties information disclosure
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The…
-
High 7.3
SourceCodester Online Student Clearance System edit-photo.php unrestricted upload
A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. Th…
-
Medium 6.8
An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain…
-
High 8.1
Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
-
Medium 4.7
A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to r…
-
Medium 6.5
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authe…
-
Medium 4.7
A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 10…
-
High 7.5CVE-2025-29448 Public exploit
Easy!Appointments Denial of Service (DoS)
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.