cve.bz

CWE-284: Improper Access Control, page 127

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2024-20319EPSS 0.2%

    A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane (SNMP) server of…

  2. 5.8CVE-2024-20315EPSS 0.5%

    A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to im…

  3. 6.5CVE-2024-1668EPSS 0.7%

    The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.11.5 via the form entries page. This makes it possible for authenticated attacker…

  4. 5.3CVE-2024-1462EPSS 0.5%

    The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when t…

  5. 4.3CVE-2024-1370EPSS 0.4%

    The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hooked via AJAX action in all versions up to, and including, 1.0.8. This makes it p…

  6. 5.3CVE-2024-0687EPSS 0.5%

    The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtai…

  7. 5.3CVE-2024-0631EPSS 0.6%

    The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_response function in all versions up to, and including, 2.11.6. This makes it possible…

  8. 5.3CVE-2024-0377EPSS 0.7%

    The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This…

  9. 4.3CVE-2024-0369EPSS 0.4%

    The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles function in all versions up to, and including, 5.0.0. This makes it possible fo…

  10. 5.3CVE-2023-6785EPSS 0.5%

    The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added …

  11. 8.0CVE-2024-28338EPSS 0.6%

    A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie.

  12. 7.3CVE-2024-26203EPSS 0.9%

    Azure Data Studio Elevation of Privilege Vulnerability

  13. 6.6CVE-2024-26201EPSS 0.9%

    Microsoft Intune Linux Agent Elevation of Privilege Vulnerability

  14. 7.8CVE-2024-21436EPSS 0.7%

    Windows Installer Elevation of Privilege Vulnerability

  15. 7.8CVE-2024-21418EPSS 0.7%

    Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability

  16. 9.8CVE-2023-36554EPSS 0.8%

    A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specia…

  17. 5.1CVE-2024-21483EPSS 0.2%

    A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA0…

  18. 9.8CVE-2022-32257EPSS 0.8%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized acces…

  19. 7.8CVE-2024-21805EPSS 0.2%

    Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is exploited, an arbitrary file may be placed in the specific folder by a user who …

  20. 7.5CVE-2024-28120EPSS 0.6%

    codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website t…

  21. 8.8CVE-2024-25501EPSS 0.8%

    An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.

  22. 9.8CVE-2024-2281EPSS 0.6%

    A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Setting Handler. The manipulation leads to …

  23. 5.5CVE-2024-23267EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences.

  24. 5.5CVE-2024-23266EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system.

  25. 3.3CVE-2024-23238EPSS 0.2%

    An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables.

  26. 8.6CVE-2024-0258EPSS 0.3%

    The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may be able to execute arbitrary code out of its sandbox or with certain elevated pr…

  27. 7.8CVE-2024-28115EPSS 0.2%

    FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist t…

  28. 9.1CVE-2023-51786EPSS 0.5%

    An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensitive information via Incorrect Access Control.

  29. 8.8CVE-2023-43318EPSS 1.1%

    TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.

  30. 8.8CVE-2023-38946EPSS 0.8%

    An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie.

  31. 9.8CVE-2023-38945EPSS 1.0%

    Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the applicatio…

  32. 4.3CVE-2024-1898EPSS 0.2%

    Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator.

  33. 5.3CVE-2024-1478EPSS 0.5%

    The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content vi…

  34. 5.3CVE-2024-1088EPSS 0.6%

    The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the REST API. This makes it possible for unauthenticated attackers to extract s…

  35. 4.4CVE-2024-20036EPSS 0.08%

    In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; I…

  36. 7.2CVE-2024-0795EPSS 0.9%

    If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have…

  37. 7.5CVE-2023-49545EPSS 0.8%

    A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.

  38. 9.8CVE-2023-49543EPSS 1.0%

    Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating.

  39. 9.4CVE-2024-21767EPSS 0.6%

    A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request.

  40. 8.8CVE-2024-27497ExploitEPSS 27%

    Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.

  41. 4.3CVE-2024-1942EPSS 0.4%

    Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts…

  42. 4.3CVE-2024-1888EPSS 0.3%

    Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already …

  43. 4.3CVE-2024-23488EPSS 0.3%

    Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

  44. 4.3CVE-2024-1887EPSS 0.3%

    Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.

  45. 9.8CVE-2024-25830ExploitEPSS 24%

    F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A su…

  46. 5.8CVE-2024-20291EPSS 0.9%

    A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should b…

  47. 5.3CVE-2024-1492EPSS 0.5%

    The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthent…

  48. 5.3CVE-2024-1475EPSS 0.5%

    The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and pag…

  49. 5.3CVE-2024-1472EPSS 0.5%

    The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's maintenance mode obtain…

  50. 5.3CVE-2024-1294EPSS 0.7%

    The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticate…