Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 7.1
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a g…
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPad…
-
Medium 6.3
easyii CMS File Upload Management Upload.php file unrestricted upload
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be init…
-
Low 3.5
Profile of disabled user stays accessible
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by admini…
-
Critical 9.8
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One…
-
Medium 6.5
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privi…
-
Medium 6.5
spx_restservice SubNet_handler_func Broken Access Control
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard fir…
-
Medium 5.3
spx_restservice KillDupUsr_func Broken Access Control
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This …
-
Medium 6.5
spx_restservice First_network_func Broken Access Control
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
Medium 5.3
spx_restservice FirstReset_handler_func Broken Access Control
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standa…
-
High 8.2
MISSING AUTHORIZATION CWE-862
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
-
High 8.2
MISSING AUTHORIZATION CWE-862
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
-
High 7.5
OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending …
-
High 8.1
Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerab…
-
High 7.5
Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file syst…
-
High 7.3
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Medium 5.3
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The …
-
High 8.1
Vulnerability in the PeopleSoft Enterprise Common Components product of Oracle PeopleSoft (component: Approval Framewor…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Critical 9.3
ZGR TPS200 NG Improper access control
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with access to the network where the affected asset is located, to operate and change several parameters wit…
-
High 7.5
HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, a…
-
Critical 9.8
TRUMPF TruTops default user accounts vulnerability
Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.
-
High 8.8
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access …
-
Medium 5.3
Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions s…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 …
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting f…
-
Medium 6.5
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 befo…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions …
-
Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user'…
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and vid…
-
High 8.2
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting…
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting…
-
Medium 4.9
Malicious agent may be able to impersonate another agent in GoCD
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive w…
-
High 7.5
Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) Ac…
-
Medium 6.5
Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker c…
-
Medium 4.0
IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to im…
-
High 7.8
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…