cve.bz

CWE-284: Improper Access Control, page 133

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2023-44248EPSS 0.2%

    An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007 and below, 4.0 all may allow a local attacker to prevent the collector service to start in the next system reboot by ta…

  2. 5.5CVE-2023-36404EPSS 0.8%

    Windows Kernel Information Disclosure Vulnerability

  3. 8.8CVE-2023-26205EPSS 0.6%

    An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to …

  4. 7.5CVE-2023-46601EPSS 0.5%

    A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that t…

  5. 6.5CVE-2023-43505EPSS 0.6%

    A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to.

  6. 6.3CVE-2023-6073EPSS 0.4%

    Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum …

  7. 3.3CVE-2023-5543EPSS 0.3%

    When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

  8. 5.3CVE-2023-5549EPSS 0.6%

    Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

  9. 4.3CVE-2023-5542EPSS 0.5%

    Students in "Only see own membership" groups could see other students in the group, which should be hidden.

  10. 5.3CVE-2023-47110EPSS 0.4%

    blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This…

  11. 7.5CVE-2023-46759EPSS 0.4%

    Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality.

  12. 5.3CVE-2023-46755EPSS 0.4%

    Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart.

  13. 9.1CVE-2023-46501EPSS 1.6%

    An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.

  14. 3.3CVE-2023-42542EPSS 0.2%

    Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device.

  15. 5.5CVE-2023-42540EPSS 0.2%

    Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent.

  16. 4.3CVE-2023-5976EPSS 0.4%

    Improper Access Control in GitHub repository microweber/microweber prior to 2.0.

  17. 9.8CVE-2018-25093EPSS 0.5%

    A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgr…

  18. 9.8CVE-2018-25092EPSS 0.5%

    A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper …

  19. 4.6CVE-2023-36620EPSS 0.5%

    An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to …

  20. 7.1CVE-2023-31020EPSS 0.2%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.

  21. 7.1CVE-2023-31019EPSS 0.2%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to …

  22. 8.8CVE-2023-43336EPSS 0.7%

    Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.

  23. 4.3CVE-2023-5916EPSS 0.5%

    A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper a…

  24. 5.3CVE-2023-20267EPSS 0.6%

    A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parse…

  25. 8.8CVE-2023-5833EPSS 0.8%

    Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.

  26. 7.5CVE-2018-17559EPSS 1.2%

    Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.

  27. 9.8CVE-2023-46665EPSS 0.8%

    Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.

  28. 9.1CVE-2023-46664EPSS 0.6%

    Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and acce…

  29. 8.1CVE-2023-46663EPSS 0.6%

    Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allows users to perform certain actions via HTTP requests without performing any validity che…

  30. 7.5CVE-2023-46662EPSS 0.8%

    Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive informa…

  31. 9.8CVE-2023-46661EPSS 0.7%

    Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.

  32. 6.5CVE-2023-46666EPSS 0.4%

    An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that…

  33. 6.5CVE-2023-45228EPSS 0.4%

    The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.

  34. 9.8CVE-2023-42769EPSS 1.1%

    The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.

  35. 6.5CVE-2023-30969EPSS 0.4%

    The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.

  36. 7.5CVE-2023-38848EPSS 0.9%

    An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.

  37. 6.8CVE-2023-45844EPSS 0.4%

    The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power managem…

  38. 9.8CVE-2023-44794EPSS 1.3%

    An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.

  39. 5.3CVE-2023-41721EPSS 0.8%

    Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration…

  40. 5.3CVE-2023-39731EPSS 0.4%

    The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.

  41. 6.8CVE-2023-46033EPSS 0.4%

    D-Link (Non-US) DSL-2750U N300 ADSL2+ and (Non-US) DSL-2730U N150 ADSL2+ are vulnerable to Incorrect Access Control. The UART/Serial interface on the PCB, provides log output and a root terminal without proper access control.

  42. 6.5CVE-2023-20261EPSS 0.7%

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are se…

  43. 8.3CVE-2023-22102EPSS 1.0%

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via m…

  44. 3.7CVE-2023-43814EPSS 0.4%

    Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for g…

  45. 9.8CVE-2023-43119EPSS 0.8%

    An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.

  46. 7.5CVE-2023-5240EPSS 0.7%

    Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.

  47. 7.8CVE-2023-43079EPSS 0.2%

    Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute arbitrary code in order to …

  48. 4.3CVE-2023-41882EPSS 0.5%

    vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaborati…

  49. 9.8CVE-2023-32632EPSS 1.3%

    A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger th…

  50. 9.8CVE-2023-24479EPSS 1.8%

    An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger…