Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Critical 9.1CVE-2024-46627 Scanner template
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
-
High 8.8
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user…
-
High 7.5
An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access …
-
High 8.4
In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an upda…
-
Medium 5.8
A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet…
-
High 7.6
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, includin…
-
High 7.6
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values …
-
High 7.5
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthentica…
-
Critical 9.8
An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Manage…
-
Critical 9.8
Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by…
-
Medium 4.3
Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control
A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFile_Load.do of the component Attachment Handler. The manipulation of …
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.0
Improper Access Control in UI upgrade process
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or …
-
Medium 5.0
SSRF Loopback IP filter bypass in directus
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.1…
-
Medium 4.8
server.fs.deny bypassed when using ?import&raw in vite
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitat…
-
Medium 6.0
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with…
-
High 7.5
Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable…
-
Low 3.3
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
Medium 4.6
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
Low 3.5
Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potential…
-
Medium 6.5
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to poten…
-
Medium 6.7
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to poten…
-
Low 3.7
Silent Desktop Screenshot Capture
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
-
High 8.8
The SYSCOM Group OMFLOW - Broken Access Control
OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining con…
-
Medium 4.7
Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user.
-
Medium 4.2
An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_us…
-
Medium 5.9
An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Managemen…
-
High 7.3
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to…
-
Medium 5.5
Cisco IOS XR Software CLI Arbitrary File Read Vulnerability
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device. This vulnerability …
-
High 8.8
RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php.
-
High 8.5
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
-
Critical 9.0
Azure Stack Hub Elevation of Privilege Vulnerability
Azure Stack Hub Elevation of Privilege Vulnerability
-
Medium 4.6
An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may al…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC …
-
Medium 6.7
Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileg…
-
High 7.5
Loftware Spectrum through 4.6 has unprotected JMX Registry.
-
High 8.2
Vulnerability in Baxter Connex Health Portal
In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.