Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Low 2.6
Nextcloud Server's disabled download shares still allow download through preview images
Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without be…
-
Medium 5.9
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
-
High 7.4
In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
-
High 7.3
SourceCodester Book Store Management System index.php access control
A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_ci/index.php. The manipulation leads to improper access controls. The attack can be initiated remote…
-
High 8.8
An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, …
-
Medium 4.1
An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2…
-
Medium 6.5
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. T…
-
Critical 9.8
There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote …
-
Low 2.6
iPXE TLS tls.c tls_new_ciphertext information exposure
A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through d…
-
Medium 5.3
WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability
Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.
-
Medium 4.3
WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability
Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.
-
Medium 6.5
WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability
Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
-
Medium 6.5
WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
-
Medium 6.5
Unauthorized modification in Karmasis Informatics Infraskope SIEM+
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.
-
High 8.8
Carel Boss Mini 1.5.0 has Improper Access Control.
-
High 8.6
Unauthorized modification in Karmasis Informatics Infraskope SIEM+
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.
-
Medium 6.2
Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Cons…
-
Medium 4.3
Missing permissions check in Liferay Portal
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via …
-
High 7.5
Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allo…
-
High 7.5
Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini…
-
High 7.5
A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adapt…
-
Low 2.6
Tauri Filesystem Scope can be Partially Bypassed
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and dr…
-
Medium 4.2
The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config u…
-
High 7.5
Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.
-
High 7.8
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SO…
-
High 7.4
The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes…
-
Medium 4.3
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local…
-
Medium 4.0
Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allow…
-
Medium 4.3
Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to…
-
Critical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with netwo…
-
Critical 9.8
The DRM module has a vulnerability in verifying the secure memory attributes. Successful exploitation of this vulnerabi…
-
High 7.5
In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images a…
-
Medium 4.3
Improper access to debug panel in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI…
-
Low 2.7
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
-
Medium 6.5
"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users wit…
-
High 7.5
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and be…
-
Medium 5.5
This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able …
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ve…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access…