cve.bz

CWE-284: Improper Access Control, page 129

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-39432EPSS 0.2%

    Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticated user to potentially enable escalation of privilege via local access.

  2. 7.8CVE-2023-39425EPSS 0.2%

    Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via local access.

  3. 7.8CVE-2023-38561EPSS 0.2%

    Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access.

  4. 7.8CVE-2023-35121EPSS 0.2%

    Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local acces…

  5. 6.7CVE-2023-35062EPSS 0.2%

    Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially enable escalation of privilege via local access.

  6. 5.5CVE-2023-33875EPSS 0.2%

    Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via local access..

  7. 7.8CVE-2023-32647EPSS 0.2%

    Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 7.8CVE-2023-31271EPSS 0.2%

    Improper access control in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 5.5CVE-2023-28715EPSS 0.2%

    Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially enable denial of service via local access.

  10. 6.1CVE-2023-28396EPSS 0.2%

    Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privileged user to enable denial of service via local access.

  11. 7.8CVE-2023-27517EPSS 0.2%

    Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.00.0483 may allow an athenticated user to potentially enable escalation of privilege via local access.

  12. 3.8CVE-2023-27303EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.

  13. 4.2CVE-2023-27301EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.

  14. 2.5CVE-2023-26596EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.

  15. 5.0CVE-2023-26585EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.

  16. 7.9CVE-2023-25777EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.

  17. 7.8CVE-2023-25174EPSS 0.2%

    Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.

  18. 5.5CVE-2023-25073EPSS 0.2%

    Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local access.

  19. 6.3CVE-2023-24481EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.

  20. 5.5CVE-2023-22848EPSS 0.2%

    Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.

  21. 7.8CVE-2023-22311EPSS 0.2%

    Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 may allow an authenticated user to potentially enable escalation of privilege via local access.

  22. 8.2CVE-2023-22293EPSS 0.2%

    Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.

  23. 7.8CVE-2023-44283EPSS 0.3%

    In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identified, impacting locally authenticated users on their respective PCs. This issue m…

  24. 7.1CVE-2024-25121EPSS 0.5%

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to…

  25. 4.3CVE-2024-25120EPSS 0.5%

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pa…

  26. 6.0CVE-2023-31346EPSS 0.3%

    Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.

  27. 7.1CVE-2023-20587EPSS 0.2%

    Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.

  28. 6.0CVE-2023-20579EPSS 0.2%

    Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.

  29. 8.8CVE-2024-24751EPSS 0.5%

    sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extens…

  30. 9.8CVE-2024-21401EPSS 1.5%

    Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

  31. 9.0CVE-2024-21376EPSS 1.2%

    Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability

  32. 9.3CVE-2024-21364EPSS 0.6%

    Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

  33. 5.7CVE-2024-20695EPSS 0.6%

    Skype for Business Information Disclosure Vulnerability

  34. 3.3CVE-2024-1439EPSS 0.3%

    Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all…

  35. 4.3CVE-2024-24776EPSS 0.3%

    Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.

  36. 8.8CVE-2024-25677EPSS 0.6%

    In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document.

  37. 6.5CVE-2024-25106EPSS 0.5%

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulner…

  38. 8.8CVE-2024-24830EPSS 0.7%

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any a…

  39. 9.8CVE-2024-24496ExploitEPSS 20%

    An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components.

  40. 5.3CVE-2024-0965EPSS 0.5%

    The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugi…

  41. 8.8CVE-2024-24824EPSS 35%

    Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. …

  42. 5.9CVE-2024-24771EPSS 0.6%

    Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromise…

  43. 6.5CVE-2024-23447EPSS 0.4%

    An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Driv…

  44. 6.5CVE-2024-23446EPSS 0.5%

    An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized…

  45. 7.8CVE-2023-32479EPSS 0.09%

    Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malici…

  46. 7.8CVE-2023-43517EPSS 0.10%

    Memory corruption in Automotive Multimedia due to improper access control in HAB.

  47. 4.3CVE-2024-1092EPSS 0.4%

    The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the feedzy dashboard in all versions…

  48. 5.3CVE-2024-0969EPSS 0.5%

    The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Default Restricti…

  49. 4.3CVE-2024-0374EPSS 0.2%

    The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation…

  50. 4.3CVE-2024-0373EPSS 0.2%

    The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation…