Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,236 results · Feed
-
High 7.6
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported …
-
High 8.7
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 8.6
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions …
-
Critical 9.9
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
High 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions …
-
Medium 6.5
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File dow…
-
Medium 6.5
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Man…
-
High 8.1
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affe…
-
High 8.1
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affe…
-
High 8.1
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affe…
-
High 8.5
Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API
A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allo…
-
Medium 6.5
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authen…
-
Medium 6.3
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execu…
-
Medium 6.3
WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. T…
-
Critical 9.8
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticat…
-
Medium 6.3
SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload
A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File resul…
-
Medium 5.3
D-Link DIR-882 CGI Binary dllog.cgi main information disclosure
A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The expl…
-
Medium 6.3
SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unre…
-
Medium 6.3
PHPGurukul Hostel Management System checklogin.php access control
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The…
-
High 7.5
IBM Sterling File Gateway is Vulnerable to Improper Access Control
IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia …
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be …
-
Medium 5.5
An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS S…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gat…
-
Medium 4.4
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Se…
-
High 8.2
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, m…
-
Medium 4.4
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may bypass Gatekeepe…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS T…
-
Medium 5.5
An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fi…
-
Medium 5.5
A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app m…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, vision…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27…
-
High 8.6
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound d…
-
Critical 9.1
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path …