cve.bz

CWE-284: Improper Access Control, page 142

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.7CVE-2022-23485EPSS 0.5%

    Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on m…

  2. 7.5CVE-2022-44932EPSS 0.7%

    An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.

  3. 5.5CVE-2022-39915EPSS 0.3%

    Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information v…

  4. 4.2CVE-2022-39910EPSS 0.3%

    Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of an unlocked device using pop-up view.

  5. 3.3CVE-2022-39906EPSS 0.1%

    Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information.

  6. 4.6CVE-2022-39900EPSS 0.2%

    Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch.

  7. 3.3CVE-2022-39898EPSS 0.1%

    Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.

  8. 3.3CVE-2022-39896EPSS 0.1%

    Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.

  9. 3.3CVE-2022-39895EPSS 0.1%

    Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent.

  10. 3.3CVE-2022-39894EPSS 0.1%

    Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.

  11. 8.1CVE-2022-37918EPSS 0.8%

    Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access …

  12. 8.1CVE-2022-37917EPSS 0.8%

    Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access …

  13. 8.1CVE-2022-37916EPSS 0.8%

    Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access …

  14. 9.8CVE-2022-35843EPSS 0.9%

    An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 th…

  15. 5.9CVE-2022-44212EPSS 0.6%

    In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.

  16. 7.4CVE-2022-44211EPSS 0.6%

    In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.

  17. 5.3CVE-2022-41970EPSS 0.6%

    Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be d…

  18. 9.8CVE-2022-4229EPSS 1.0%

    A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_ci/index.php. The manipulation leads to improper access controls. The attack can…

  19. 8.8CVE-2022-44037EPSS 0.6%

    An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin ri…

  20. 6.5CVE-2022-45475EPSS 0.9%

    Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.

  21. 2.7CVE-2022-38377EPSS 0.6%

    An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through …

  22. 9.8CVE-2022-39070EPSS 0.9%

    There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation.

  23. 4.3CVE-2022-4087EPSS 0.5%

    A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to informatio…

  24. 9.8CVE-2022-41155EPSS 0.8%

    Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

  25. 5.3CVE-2022-41135EPSS 0.5%

    Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

  26. 6.5CVE-2022-40216EPSS 0.5%

    Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

  27. 9.9CVE-2022-34827EPSS 0.8%

    Carel Boss Mini 1.5.0 has Improper Access Control.

  28. 9.8CVE-2022-41652EPSS 0.8%

    Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

  29. 6.5CVE-2022-24038EPSS 0.6%

    Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.

  30. 8.6CVE-2022-24036EPSS 0.5%

    Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.

  31. 7.5CVE-2022-20918EPSS 0.9%

    A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module, Cisco Firepower Management Center (FMC) Software, and Cisco Next-Generati…

  32. 5.5CVE-2022-25679EPSS 0.10%

    Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

  33. 4.3CVE-2022-42126EPSS 0.7%

    The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view …

  34. 7.8CVE-2022-36789EPSS 0.2%

    Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may allow a privileged user to potentially enable escalation of privilege via local ac…

  35. 6.7CVE-2022-35276EPSS 0.2%

    Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.

  36. 5.3CVE-2022-43679EPSS 0.4%

    The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages.

  37. 3.3CVE-2022-39889EPSS 0.2%

    Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allows attackers to access wearable device information.

  38. 3.3CVE-2022-39887EPSS 0.08%

    Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting.

  39. 3.3CVE-2022-39884EPSS 0.08%

    Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to Call information.

  40. 9.8CVE-2022-31687EPSS 0.9%

    VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the ap…

  41. 7.5CVE-2022-27673EPSS 0.6%

    Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.

  42. 9.8CVE-2021-46851EPSS 0.5%

    The DRM module has a vulnerability in verifying the secure memory attributes. Successful exploitation of this vulnerability may cause abnormal video playback.

  43. 7.8CVE-2021-26360EPSS 0.2%

    An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to…

  44. 9.8CVE-2022-25932EPSS 0.7%

    The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulne…

  45. 7.5CVE-2022-42707EPSS 0.7%

    In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.

  46. 6.5CVE-2022-22442EPSS 0.6%

    "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper access controls. IBM X-Force ID: 224427."

  47. 4.3CVE-2022-39370EPSS 0.5%

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug pa…

  48. 5.3CVE-2022-44622EPSS 0.6%

    In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive

  49. 5.5CVE-2022-42814EPSS 0.3%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.

  50. 5.5CVE-2022-42811EPSS 0.3%

    An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to access user-sensitive data.