Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in m…
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in S…
-
Unscored —
MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
-
Medium 5.7
DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
-
Low 3.3
Moodle: duplicating a bigbluebutton activity assigns the same meeting id
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.
-
Low 3.3
Moodle: insufficient capability checks when updating the parent of a course category
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
-
Low 3.3
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
-
Critical 9.1
Any value can be changed in the configuration table by an employee having access to block reassurance module
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has b…
-
Unscored —
Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service c…
-
Medium 5.3
Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerabili…
-
Low 3.3
Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID…
-
Medium 4.0
Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitiv…
-
Medium 4.6
Improper Access Control in microweber/microweber
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
-
Critical 9.1CVE-2023-46501 Public exploit
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view …
-
Medium 5.5
Vaerys-Dawn DiscordSailv2 Tag access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.1…
-
Medium 5.5
Vaerys-Dawn DiscordSailv2 Command Mention access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upg…
-
Unscored —
An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the …
-
Medium 6.1
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.
-
High 7.8
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonat…
-
Medium 4.3
Lissy93 Dashy Configuration save access control
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It i…
-
Unscored —
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access cont…
-
Medium 4.0
A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially b…
-
High 8.1
Improper Access Control in mintplex-labs/anything-llm
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
-
Critical 9.8
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind …
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the re…
-
High 7.5
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive information.
-
Critical 9.8
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.
-
Medium 6.5
Sielco Radio Link and Analog FM Transmitters Improper Access Control
The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.
-
Medium 5.3
Elastic Sharepoint Online Python Connector Improper Access Control
An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have rea…
-
Critical 9.8
Sielco Radio Link and Analog FM Transmitters Improper Access Control
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
-
High 7.5
Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS…
-
High 8.2
Palantir Tiles missing authentication on API endpoints
The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
-
High 7.3
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an a…
-
Critical 10.0
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and …
-
Unscored —
An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET …
-
Critical 9.8
SaToken privilege escalation vulnerability
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
-
Unscored —
The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send…
-
Unscored —
D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U N150 ADSL2+ are vulnerable to Incorrect Access Control. Th…
-
Medium 6.5
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retriev…