cve.bz

CWE-284: Improper Access Control, page 137

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-33946EPSS 0.6%

    The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objec…

  2. 8.1CVE-2023-2845EPSS 0.7%

    Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.

  3. 7.5CVE-2023-23446EPSS 0.9%

    Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the…

  4. 7.5CVE-2023-23445EPSS 0.7%

    Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpr…

  5. 6.7CVE-2023-31199EPSS 0.2%

    Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of privilege via local access.

  6. 6.7CVE-2023-30768EPSS 0.2%

    Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a privileged user to potentially enable escalation of privilege via local access.

  7. 7.8CVE-2023-29242EPSS 0.1%

    Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 4.3CVE-2023-2674EPSS 0.6%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

  9. 8.8CVE-2023-2670EPSS 0.8%

    A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/?page=user/manage_user. The manipulation leads to improper acces…

  10. 9.1CVE-2023-1834EPSS 1.3%

    Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default.  This could potentially allow attackers unauthorized acce…

  11. 5.3CVE-2023-0858EPSS 0.6%

    Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Ser…

  12. 5.5CVE-2023-25771EPSS 0.1%

    Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.

  13. 4.4CVE-2023-23573EPSS 0.2%

    Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure via local access.

  14. 7.8CVE-2023-22312EPSS 0.2%

    Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

  15. 5.5CVE-2022-46279EPSS 0.2%

    Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable information disclosure via local access.

  16. 6.7CVE-2022-42465EPSS 0.2%

    Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileged user to potentially enable escalation of privilege via local access.

  17. 7.8CVE-2022-41784EPSS 0.2%

    Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authenticated user to potentially enable escalation of privilege via local access

  18. 7.8CVE-2022-41769EPSS 0.2%

    Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of privilege via local access.

  19. 7.8CVE-2022-41690EPSS 0.2%

    Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authenticated user to potentially enable escalation of privilege via local access.

  20. 5.5CVE-2022-41621EPSS 0.2%

    Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable information disclosure via local access.

  21. 7.8CVE-2022-40972EPSS 0.1%

    Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  22. 7.8CVE-2022-40207EPSS 0.2%

    Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalation of privilege via local access.

  23. 4.4CVE-2022-32582EPSS 0.2%

    Improper access control in firmware for some Intel(R) NUC Boards, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Pro Compute Element may allow a privileged user to potentially enable denial of service vi…

  24. 7.8CVE-2022-32578EPSS 0.1%

    Improper access control for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  25. 7.8CVE-2023-24905EPSS 0.7%

    Remote Desktop Client Remote Code Execution Vulnerability

  26. 6.5CVE-2023-32060EPSS 0.5%

    DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settin…

  27. 6.5CVE-2023-31138EPSS 0.6%

    DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH…

  28. 5.5CVE-2023-21495EPSS 0.2%

    Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set.

  29. 5.5CVE-2023-21493EPSS 0.2%

    Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data.

  30. 7.8CVE-2023-21491EPSS 0.2%

    Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege.

  31. 7.1CVE-2023-21490EPSS 0.1%

    Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager.

  32. 7.8CVE-2023-21488EPSS 0.1%

    Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips.

  33. 7.8CVE-2023-28070EPSS 0.1%

    Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A local malicious user could potentially exploit this vulnerability during installation or update process leading to privi…

  34. 7.8CVE-2023-21642EPSS 0.1%

    Memory corruption in HAB Memory management due to broad system privileges via physical address.

  35. 9.8CVE-2023-2429EPSS 0.5%

    Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

  36. 7.8CVE-2023-25496EPSS 0.2%

    A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges.

  37. 6.5CVE-2023-24512EPSS 0.6%

    On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Te…

  38. 8.1CVE-2021-45111EPSS 0.8%

    Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.

  39. 4.3CVE-2021-44465EPSS 0.5%

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, v…

  40. 6.5CVE-2021-44460EPSS 0.7%

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC req…

  41. 7.5CVE-2021-23203EPSS 0.9%

    Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

  42. 7.5CVE-2021-23178EPSS 0.6%

    Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method …

  43. 6.5CVE-2021-23176EPSS 0.8%

    Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.

  44. 9.8CVE-2023-29924EPSS 1.1%

    PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.

  45. 6.5CVE-2023-2202EPSS 0.5%

    Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.

  46. 9.8CVE-2023-27350KEVExploitEPSS >99.9%

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompl…

  47. 7.8CVE-2023-2112EPSS 0.2%

    Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

  48. 5.3CVE-2023-29922ExploitEPSS 3.0%

    PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.

  49. 5.5CVE-2023-29586EPSS 0.3%

    Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the system to a directory they control. NOTE…

  50. 5.3CVE-2023-29921EPSS 0.5%

    PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.