cve.bz

CWE-284: Improper Access Control, page 134

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-36790EPSS 0.5%

    Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability

  2. 7.8CVE-2023-36725EPSS 0.5%

    Windows Kernel Elevation of Privilege Vulnerability

  3. 4.4CVE-2023-36722EPSS 1.4%

    Active Directory Domain Services Information Disclosure Vulnerability

  4. 7.3CVE-2023-36561EPSS 0.9%

    Azure DevOps Server Elevation of Privilege Vulnerability

  5. 9.6CVE-2023-41679EPSS 0.7%

    An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with a…

  6. 4.3CVE-2023-33301EPSS 0.6%

    An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host.

  7. 6.7CVE-2023-37194EPSS 0.2%

    A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 1628 (All versions). The kernel memory of affected devices is…

  8. 9.8CVE-2023-5365EPSS 0.8%

    HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.

  9. 6.5CVE-2023-36820EPSS 0.5%

    Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same…

  10. 9.8CVE-2023-43696EPSS 0.9%

    Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server.

  11. 7.1CVE-2023-36465EPSS 0.7%

    Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allo…

  12. 7.8CVE-2023-43072EPSS 0.2%

    Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker could potentially exploit this vulnerability, leading to ability to execute arbrit…

  13. 8.1CVE-2023-1832EPSS 0.6%

    An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.

  14. 7.8CVE-2023-22618EPSS 0.2%

    If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manipulating a web request. This affects (for example) WaveLite Metro 200 and Fan, Wa…

  15. 8.8CVE-2023-0506EPSS 0.6%

    The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain …

  16. 6.5CVE-2023-5353EPSS 0.7%

    Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.

  17. 7.8CVE-2023-24844EPSS 0.1%

    Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

  18. 7.8CVE-2023-21673EPSS 0.1%

    Improper Access to the VM resource manager can lead to Memory Corruption.

  19. 4.9CVE-2023-32572EPSS 0.5%

    A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.

  20. 2.7CVE-2023-28372EPSS 0.5%

    A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.

  21. 9.8CVE-2023-5288EPSS 0.8%

    A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload a new firmware version to the device.

  22. 7.8CVE-2023-32477EPSS 0.2%

    Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-privileged malicious user may potentially exploit this vulnerability to gain elevated privileges.

  23. 8.2CVE-2023-20223EPSS 0.6%

    A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access cont…

  24. 7.8CVE-2023-32458EPSS 0.2%

    Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerability in Embedded Service Enabler component. A local malicious user could potentially exploit this vulnerability during …

  25. 8.8CVE-2023-41322EPSS 0.9%

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can mak…

  26. 5.3CVE-2023-41311EPSS 0.4%

    Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to be activated automatically.

  27. 6.5CVE-2023-39376EPSS 0.4%

    SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network

  28. 9.8CVE-2023-43141EPSS 0.8%

    TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

  29. 7.5CVE-2023-25525EPSS 0.6%

    NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DIPv6 set to the link-local address of the SVI interface may be incorrectly forwarded. A successful e…

  30. 9.8CVE-2022-47558EPSS 0.6%

    Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or …

  31. 5.3CVE-2023-38206EPSS 0.7%

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnera…

  32. 7.5CVE-2023-38205KEVExploitEPSS 99.7%

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnera…

  33. 7.5CVE-2023-40850EPSS 0.9%

    netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. There is a file leak in the website source code of the application security gateway.

  34. 7.5CVE-2023-20191EPSS 0.6%

    A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to in…

  35. 4.3CVE-2023-36638EPSS 0.4%

    An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 t…

  36. 7.8CVE-2023-34470EPSS 0.2%

    AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.

  37. 4.6CVE-2023-34469EPSS 0.2%

    AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulnerability may lead to a loss of confidentiality.

  38. 8.8CVE-2023-40730EPSS 0.6%

    A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to access confidential information, perfor…

  39. 7.8CVE-2023-3039EPSS 0.2%

    SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.

  40. 9.8CVE-2023-40039EPSS 1.2%

    An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon frame.

  41. 9.8CVE-2023-37759ExploitEPSS 7.0%

    Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.

  42. 7.2CVE-2023-40060EPSS 1.0%

    A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.…

  43. 4.3CVE-2023-36635EPSS 0.5%

    An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.

  44. 7.4CVE-2021-40699EPSS 0.6%

    ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerabi…

  45. 7.2CVE-2021-36036EPSS 2.1%

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the websit…

  46. 9.8CVE-2023-31242EPSS 3.5%

    An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a…

  47. 9.8CVE-2023-4696EPSS 1.1%

    Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.

  48. 4.7CVE-2023-4650EPSS 0.5%

    Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

  49. 7.5CVE-2023-4640EPSS 0.4%

    The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes …

  50. 6.1CVE-2023-40170EPSS 0.6%

    jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab"…