cve.bz

CWE-284: Improper Access Control, page 140

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2022-30564EPSS 0.4%

    Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time.

  2. 8.8CVE-2022-47648EPSS 0.4%

    An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publi…

  3. 5.7CVE-2023-25150EPSS 0.7%

    Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with…

  4. 9.8CVE-2023-0744ExploitEPSS 6.4%

    Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.

  5. 5.3CVE-2023-23615EPSS 0.5%

    Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions o…

  6. 9.8CVE-2022-47699EPSS 0.6%

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control.

  7. 6.5CVE-2023-24425EPSS 0.8%

    Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kube…

  8. 9.8CVE-2023-24022EPSS 1.6%

    Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are…

  9. 7.5CVE-2023-0451EPSS 0.8%

    Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users i…

  10. 6.5CVE-2022-40036EPSS 0.7%

    An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserList component.

  11. 9.8CVE-2022-31704ExploitEPSS 81%

    The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.

  12. 7.5CVE-2023-22960EPSS 28%

    Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.

  13. 4.3CVE-2023-24058EPSS 1.0%

    Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affec…

  14. 9.8CVE-2023-24028EPSS 0.7%

    In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.

  15. 7.5CVE-2020-22655EPSS 0.5%

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) befo…

  16. 7.5CVE-2023-22339EPSS 1.2%

    Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product.

  17. 4.3CVE-2022-46890EPSS 0.7%

    Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).

  18. 7.8CVE-2022-34457EPSS 0.2%

    Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non…

  19. 6.3CVE-2023-21860EPSS 0.6%

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported versions that are affected are 7.4.38 and prior, 7.5.28 and prior, 7.6.24 and prior and 8.0.31 and prior. Difficult to exploi…

  20. 7.3CVE-2023-21894EPSS 0.2%

    Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer issues). Supported versions that are affected are Prior to 13.9.4.2.11. Easily exploitable vul…

  21. 7.5CVE-2023-21893EPSS 0.6%

    Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS…

  22. 7.5CVE-2023-21857EPSS 0.5%

    Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated atta…

  23. 7.5CVE-2023-21855EPSS 0.5%

    Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticate…

  24. 7.5CVE-2023-21854EPSS 0.5%

    Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with netw…

  25. 7.5CVE-2023-21853EPSS 0.5%

    Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker wi…

  26. 7.5CVE-2023-21852EPSS 0.5%

    Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network …

  27. 7.5CVE-2023-21851EPSS 0.5%

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with…

  28. 7.5CVE-2023-21850EPSS 0.5%

    Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated at…

  29. 7.5CVE-2023-21849EPSS 0.6%

    Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with networ…

  30. 8.8CVE-2023-21846EPSS 0.6%

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged atta…

  31. 8.8CVE-2023-21832EPSS 0.6%

    Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged atta…

  32. 8.1CVE-2023-21828EPSS 0.6%

    Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privile…

  33. 8.1CVE-2022-46331EPSS 0.5%

    An unauthorized user could possibly delete any file on the system.

  34. 6.5CVE-2022-43494EPSS 0.6%

    An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.

  35. 9.8CVE-2022-43977EPSS 0.6%

    An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control.

  36. 9.8CVE-2015-10057EPSS 0.7%

    A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The…

  37. 8.1CVE-2023-22600EPSS 0.5%

    InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT to…

  38. 4.3CVE-2023-22487EPSS 0.7%

    Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior nev…

  39. 7.1CVE-2023-21752ExploitEPSS 5.5%

    Windows Backup Service Elevation of Privilege Vulnerability

  40. 7.1CVE-2023-21750EPSS 0.7%

    Windows Kernel Elevation of Privilege Vulnerability

  41. 8.8CVE-2023-21742EPSS 56%

    Microsoft SharePoint Server Remote Code Execution Vulnerability

  42. 7.0CVE-2023-21531EPSS 0.6%

    Azure Service Fabric Container Elevation of Privilege Vulnerability

  43. 4.3CVE-2022-45166EPSS 0.5%

    An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data u…

  44. 4.3CVE-2022-45164EPSS 0.4%

    An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created by someone else - even if this basic user is not a member of the booking

  45. 7.8CVE-2022-36443EPSS 0.2%

    An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card) but it is still possible to use a physical connection (Ethernet cable) without r…

  46. 5.5CVE-2022-36442EPSS 0.2%

    An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK.

  47. 7.1CVE-2022-36441EPSS 0.2%

    An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin.

  48. 4.3CVE-2022-4711EPSS 0.7%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those wit…

  49. 6.5CVE-2022-4709EPSS 0.6%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those wit…

  50. 6.5CVE-2022-4708EPSS 0.6%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those wi…