cve.bz

CWE-284: Improper Access Control, page 141

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2022-4705EPSS 0.6%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with s…

  2. 8.1CVE-2022-4704EPSS 0.8%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with s…

  3. 8.1CVE-2022-4703EPSS 1.0%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with …

  4. 6.5CVE-2022-4702EPSS 0.8%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those wit…

  5. 8.8CVE-2022-4700EPSS 0.8%

    The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those wit…

  6. 9.8CVE-2023-22903EPSS 0.7%

    api/views/user.py in LibrePhotos before e19e539 has incorrect access control.

  7. 9.8CVE-2023-0017EPSS 16%

    An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unaut…

  8. 6.7CVE-2023-0012EPSS 0.2%

    In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default al…

  9. 2.1CVE-2023-22473EPSS 0.6%

    Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physic…

  10. 7.8CVE-2022-23508EPSS 0.3%

    Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's…

  11. 4.3CVE-2014-125054EPSS 0.6%

    A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The…

  12. 5.3CVE-2022-47543EPSS 0.4%

    An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.

  13. 9.8CVE-2021-4300EPSS 0.7%

    A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads t…

  14. 8.1CVE-2022-47634EPSS 0.5%

    M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain HTTP endpoints, aka LINK-2867.

  15. 7.8CVE-2022-34672EPSS 0.2%

    NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the software by gaining privileges, reading sensitive information, or executing commands.

  16. 4.3CVE-2022-4814EPSS 0.6%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

  17. 4.3CVE-2022-4810EPSS 0.5%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

  18. 8.8CVE-2022-4809EPSS 1.0%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

  19. 4.3CVE-2022-4807EPSS 0.6%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

  20. 9.8CVE-2022-45778EPSS 0.8%

    https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of…

  21. 7.5CVE-2022-45431EPSS 0.7%

    Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unau…

  22. 3.7CVE-2022-45430EPSS 0.4%

    Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could en…

  23. 9.8CVE-2022-4724EPSS 0.9%

    Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.

  24. 6.5CVE-2022-44014EPSS 0.8%

    An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPagg…

  25. 5.3CVE-2022-44565EPSS 0.5%

    An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device.

  26. 8.8CVE-2022-4689EPSS 0.8%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

  27. 8.8CVE-2022-4684EPSS 0.6%

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

  28. 5.3CVE-2022-23513ExploitEPSS 42%

    Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on …

  29. 4.3CVE-2022-41654EPSS 19%

    An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger …

  30. 7.5CVE-2022-3186EPSS 0.6%

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices…

  31. 5.8CVE-2022-38655EPSS 0.4%

    BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

  32. 9.8CVE-2022-38546EPSS 0.7%

    A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.

  33. 8.8CVE-2022-44643EPSS 0.5%

    A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenant…

  34. 9.8CVE-2022-28173EPSS 0.7%

    The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

  35. 8.1CVE-2022-4567EPSS 0.6%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.

  36. 4.9CVE-2022-31708EPSS 0.8%

    vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.

  37. 6.7CVE-2022-25627EPSS 0.9%

    An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4

  38. 5.5CVE-2022-42865EPSS 0.3%

    This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to bypass Privacy preferences.

  39. 5.5CVE-2022-42862EPSS 0.3%

    This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Privacy preferences.

  40. 8.8CVE-2022-42861EPSS 0.3%

    This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to break out of its sandbox.

  41. 5.5CVE-2022-42859EPSS 0.3%

    Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be able to bypass Privacy preferences.

  42. 5.5CVE-2022-42853EPSS 0.2%

    An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the file system.

  43. 4.3CVE-2022-32945EPSS 0.3%

    An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods.

  44. 6.5CVE-2022-47407EPSS 0.4%

    An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modif…

  45. 5.5CVE-2022-38355EPSS 0.4%

    Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose sensitive information stored by the affected product without requiring authenti…

  46. 8.1CVE-2022-46664EPSS 0.7%

    A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4), Mendix Workflow Commons V2.3 (All versions < V2.3.2). Affected versions of the module improperly …

  47. 5.3CVE-2022-46354EPSS 0.7%

    A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), …

  48. 6.5CVE-2022-45937EPSS 0.7%

    A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (A…

  49. 8.1CVE-2022-45936EPSS 0.8%

    A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle access control for some module entities. This could allow authenticated remote attackers to read and m…

  50. 5.5CVE-2022-41261EPSS 0.2%

    SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access oth…