CWE-284: Improper Access Control, page 136
Filter
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
What the weakness is: CWE-284 at MITRE
Ask an AI about CWE-284
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.5CVE-2023-24486EPSS 0.2%
A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same …
- 7.5CVE-2023-3273EPSS 1.1%
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP address based on missing access control.
- 7.5CVE-2023-3271EPSS 0.9%
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints.
- 7.5CVE-2023-35940EPSS 0.7%
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contain…
- 8.1CVE-2023-35939EPSS 0.6%
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat acto…
- 6.5CVE-2023-34107EPSS 0.6%
GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all Know…
- 6.5CVE-2023-34106EPSS 0.6%
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of a…
- 7.8CVE-2023-21518EPSS 0.2%
Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.
- 5.3CVE-2023-3431EPSS 0.9%
Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
- 8.1CVE-2023-35927EPSS 0.8%
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.…
- 6.5CVE-2023-35173EPSS 0.5%
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommende…
- 6.3CVE-2023-35167EPSS 0.5%
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `i…
- 5.4CVE-2023-3304EPSS 0.4%
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- 3.5CVE-2023-3303EPSS 0.4%
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- 7.3CVE-2023-1862EPSS 0.8%
Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger…
- 9.8CVE-2023-3306EPSS 23%
A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation le…
- 7.5CVE-2023-3305EPSS 0.8%
A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation H…
- 4.3CVE-2023-28810EPSS 10%
Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the…
- 7.5CVE-2023-28809EPSS 0.6%
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the s…
- 8.8CVE-2023-32009EPSS 0.4%
Windows Collaborative Translation Framework Elevation of Privilege Vulnerability
- 8.1CVE-2023-24546EPSS 0.5%
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration da…
- 7.2CVE-2022-39946EPSS 0.7%
An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on t…
- 5.3CVE-2023-2159EPSS 0.8%
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setti…
- 9.8CVE-2021-4380ExploitEPSS 4.5%
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, …
- 4.3CVE-2021-4364EPSS 0.7%
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possibl…
- 8.8CVE-2021-4361EPSS 1.2%
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possib…
- 8.8CVE-2021-4360EPSS 1.2%
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a n…
- 5.3CVE-2021-4352EPSS 0.8%
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated at…
- 5.4CVE-2021-4338EPSS 0.6%
The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated att…
- 6.5CVE-2020-36721EPSS 1.0%
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the …
- 8.8CVE-2020-36700EPSS 1.2%
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for a…
- 4.3CVE-2020-36699EPSS 0.8%
The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9.…
- 6.4CVE-2023-2183EPSS 1.0%
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a…
- 7.8CVE-2023-21670EPSS 0.1%
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
- 7.8CVE-2022-40529EPSS 0.10%
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
- 7.1CVE-2023-3099EPSS 0.3%
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation l…
- 7.8CVE-2023-3096EPSS 0.3%
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be a…
- 6.5CVE-2023-3095EPSS 0.4%
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- 7.8CVE-2023-28066EPSS 0.2%
Dell OS Recovery Tool, versions 2.2.4013 and 2.3.7012.0, contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability in order to elevate privileges on the syst…
- 8.8CVE-2023-3018EPSS 0.7%
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access cont…
- 6.5CVE-2023-2940EPSS 0.7%
Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security seve…
- 8.8CVE-2023-2979EPSS 0.8%
A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the at…
- 8.8CVE-2023-33191EPSS 0.5%
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
- 8.1CVE-2023-2946EPSS 0.5%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- 5.4CVE-2023-2944EPSS 0.4%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- 6.5CVE-2023-2903EPSS 0.7%
A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper acce…
- 6.5CVE-2023-2902EPSS 0.7%
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=168181352078…
- 6.5CVE-2023-2901EPSS 0.7%
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=16808554797…
- 7.8CVE-2021-25749EPSS 0.2%
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
- 4.3CVE-2023-33947EPSS 0.6%
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view obj…