cve.bz

CWE-284: Improper Access Control, page 126

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2024-2731EPSS 0.4%

    Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and monitoring campaig…

  2. 7.5CVE-2024-1308EPSS 0.7%

    The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This ma…

  3. 5.3CVE-2024-0899EPSS 0.6%

    The s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 230815 via the …

  4. 5.3CVE-2024-0626EPSS 0.6%

    The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it po…

  5. 8.8CVE-2024-29993EPSS 2.0%

    Azure CycleCloud Elevation of Privilege Vulnerability

  6. 9.0CVE-2024-29990EPSS 18%

    Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

  7. 7.2CVE-2024-29055EPSS 2.3%

    Microsoft Defender for IoT Elevation of Privilege Vulnerability

  8. 7.2CVE-2024-29054EPSS 2.3%

    Microsoft Defender for IoT Elevation of Privilege Vulnerability

  9. 4.1CVE-2024-28922EPSS 0.7%

    Secure Boot Security Feature Bypass Vulnerability

  10. 6.2CVE-2024-28917EPSS 0.9%

    Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

  11. 6.7CVE-2024-26234EPSS 4.9%

    Proxy Driver Spoofing Vulnerability

  12. 6.5CVE-2024-21424EPSS 1.9%

    Azure Compute Gallery Elevation of Privilege Vulnerability

  13. 6.5CVE-2024-31805EPSS 0.5%

    TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg function.

  14. 7.5CVE-2024-27895EPSS 0.3%

    Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.

  15. 7.5CVE-2023-52537EPSS 0.4%

    Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability.

  16. 7.5CVE-2024-30418EPSS 0.4%

    Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availability.

  17. 6.5CVE-2024-2447EPSS 0.2%

    Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via…

  18. 3.8CVE-2024-29221EPSS 0.3%

    Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the in…

  19. 3.1CVE-2024-21848EPSS 0.3%

    Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel

  20. 5.9CVE-2024-31207EPSS 0.7%

    Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been pat…

  21. 3.5CVE-2024-30261EPSS 0.8%

    Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patche…

  22. 5.3CVE-2023-36644EPSS 1.0%

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin.

  23. 5.3CVE-2023-36643EPSS 0.7%

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function.

  24. 5.3CVE-2024-1418EPSS 0.4%

    The CGC Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 via the REST API. This makes it possible for unauthenticated attackers to view protected posts via REST…

  25. 6.5CVE-2024-3270EPSS 0.6%

    A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remot…

  26. 4.3CVE-2024-20302EPSS 0.4%

    A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or delete tenant templates on an affected system. This vulnerability is due to i…

  27. 4.3CVE-2024-20283EPSS 0.4%

    A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An a…

  28. 7.5CVE-2024-27605EPSS 0.4%

    Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.

  29. 9.1CVE-2024-27602EPSS 0.4%

    Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.

  30. 4.5CVE-2024-3164EPSS 0.5%

    In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a …

  31. 7.2CVE-2024-28405EPSS 0.8%

    SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.

  32. 8.2CVE-2024-28960EPSS 0.8%

    An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

  33. 6.0CVE-2024-28016EPSS 0.5%

    Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, …

  34. 6.5CVE-2024-25962EPSS 0.4%

    Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to monitoring data.

  35. 7.5CVE-2024-25736ExploitEPSS 4.3%

    An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.

  36. 8.8CVE-2023-50702EPSS 0.6%

    Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write access to %PROGRAMDATA%\SSCService). Consequently, low-privileged users can execute…

  37. 9.1CVE-2024-29866EPSS 0.7%

    Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.

  38. 6.5CVE-2024-25811EPSS 0.6%

    An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.

  39. 8.8CVE-2023-49978EPSS 0.8%

    Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators.

  40. 9.1CVE-2020-26942EPSS 0.5%

    An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword operation request, subsequently setting a new arbitrary password for the admin acc…

  41. 5.3CVE-2024-1473EPSS 0.5%

    The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post an…

  42. 6.5CVE-2024-1144EPSS 0.3%

    Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials.

  43. 7.4CVE-2024-20767KEVExploitEPSS 99%

    ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. E…

  44. 9.1CVE-2021-47155EPSS 0.5%

    The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

  45. 7.5CVE-2022-47037EPSS 0.5%

    Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.

  46. 9.8CVE-2022-47036EPSS 0.5%

    Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the…

  47. 6.5CVE-2024-2481EPSS 1.0%

    A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper ac…

  48. 9.8CVE-2024-28390EPSS 0.6%

    An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.

  49. 4.3CVE-2024-25653EPSS 0.4%

    Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web U…

  50. 5.8CVE-2024-20322EPSS 0.5%

    A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due…