cve.bz

CWE-284: Improper Access Control, page 138

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-29513EPSS 0.7%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong …

  2. 7.7CVE-2023-21985EPSS 0.2%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure whe…

  3. 7.1CVE-2023-21980EPSS 0.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker wit…

  4. 6.7CVE-2023-21969EPSS 0.2%

    Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SQL …

  5. 3.7CVE-2023-21968EPSS 1.0%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enter…

  6. 8.3CVE-2023-21923EPSS 0.6%

    Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows …

  7. 6.8CVE-2023-21922EPSS 0.5%

    Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Difficult to exploit vulnerability allow…

  8. 6.1CVE-2023-21905EPSS 0.6%

    Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub). Supported versions that are affected are 14.5, 14.6 and 14.7. Easily exploitable vulnerability all…

  9. 8.8CVE-2023-30539EPSS 0.6%

    Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files …

  10. 5.4CVE-2023-2104EPSS 0.4%

    Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

  11. 7.8CVE-2023-26408EPSS 4.3%

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…

  12. 7.8CVE-2023-26406EPSS 4.2%

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…

  13. 9.8CVE-2023-28808EPSS 0.8%

    Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

  14. 6.5CVE-2023-28312EPSS 1.5%

    Azure Machine Learning Information Disclosure Vulnerability

  15. 7.5CVE-2023-28300EPSS 1.0%

    Azure Service Connector Security Feature Bypass Vulnerability

  16. 7.8CVE-2023-28246EPSS 0.4%

    Windows Registry Elevation of Privilege Vulnerability

  17. 8.1CVE-2023-24544EPSS 0.3%

    Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follow…

  18. 4.3CVE-2023-23575EPSS 0.7%

    Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the p…

  19. 7.8CVE-2023-28051EPSS 0.2%

    Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attacker could potentially exploit this vulnerability to elevate privileges on the system.

  20. 5.3CVE-2023-0319EPSS 0.7%

    An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to …

  21. 5.4CVE-2023-1883EPSS 0.5%

    Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

  22. 3.5CVE-2023-28845EPSS 0.4%

    Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information ab…

  23. 6.5CVE-2023-28844EPSS 0.6%

    Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been address…

  24. 6.5CVE-2023-28645EPSS 0.7%

    Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich document…

  25. 5.3CVE-2023-29140EPSS 0.4%

    An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.

  26. 7.5CVE-2023-28877EPSS 0.5%

    The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.)

  27. 8.8CVE-2022-47542EPSS 0.6%

    Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.

  28. 6.5CVE-2022-24972EPSS 0.6%

    This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerabili…

  29. 5.3CVE-2023-22250EPSS 1.0%

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the …

  30. 8.8CVE-2023-1647EPSS 0.8%

    Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.

  31. 5.5CVE-2023-28443EPSS 0.3%

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permiss…

  32. 8.6CVE-2023-26360KEVExploitEPSS 97%

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation …

  33. 7.8CVE-2023-20065EPSS 0.4%

    A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to insufficient restric…

  34. 9.8CVE-2023-1557EPSS 0.5%

    A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username H…

  35. 5.5CVE-2023-25595EPSS 0.2%

    A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to ret…

  36. 7.5CVE-2023-27578EPSS 0.8%

    Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as th…

  37. 5.5CVE-2023-1491EPSS 0.3%

    A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to impro…

  38. 5.5CVE-2023-1490EPSS 0.3%

    A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to impr…

  39. 7.8CVE-2023-1489EPSS 0.5%

    A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler…

  40. 7.1CVE-2023-1486EPSS 0.5%

    A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulati…

  41. 7.1CVE-2023-1453EPSS 0.3%

    A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to i…

  42. 9.8CVE-2023-28531EPSS 3.0%

    ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

  43. 5.5CVE-2023-21465EPSS 0.2%

    Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files.

  44. 3.3CVE-2023-21463EPSS 0.1%

    Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.03.0 in Android 13 allows local attacker to get sensitive information of secret mode in Samsung Inte…

  45. 8.1CVE-2023-21457EPSS 0.2%

    Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission.

  46. 9.1CVE-2023-0811EPSS 0.6%

    Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may …

  47. 7.5CVE-2023-27875EPSS 0.6%

    IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

  48. 9.8CVE-2023-1432EPSS 0.6%

    A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request…

  49. 9.8CVE-2023-24468EPSS 0.9%

    Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2

  50. 5.3CVE-2023-27268EPSS 0.4%

    SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to acces…