cve.bz

CWE-284: Improper Access Control, page 147

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.3CVE-2022-28778EPSS 0.2%

    Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder without Samsung Security Supporter permission

  2. 3.3CVE-2022-28777EPSS 0.2%

    Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.

  3. 3.3CVE-2022-28775EPSS 0.3%

    Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission.

  4. 5.5CVE-2022-28542EPSS 0.3%

    Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Store permission.

  5. 7.8CVE-2022-27838EPSS 0.2%

    Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege.

  6. 7.8CVE-2022-27836EPSS 0.1%

    Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds prop…

  7. 5.5CVE-2022-27822EPSS 0.1%

    Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permission.

  8. 6.8CVE-2022-26091EPSS 0.1%

    Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key of hardware keyboard.

  9. 4.6CVE-2022-25831EPSS 0.1%

    Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions.

  10. 7.8CVE-2022-20762EPSS 0.3%

    A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could allow an authenticated, local attacker to escalate privileges on an affected devic…

  11. 8.8CVE-2021-36776EPSS 1.1%

    A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.

  12. 8.8CVE-2021-36775EPSS 1.0%

    a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions pr…

  13. 4.3CVE-2022-0405EPSS 0.8%

    Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

  14. 7.5CVE-2021-28504EPSS 0.7%

    On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP…

  15. 4.9CVE-2022-24731EPSS 1.0%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read…

  16. 6.5CVE-2022-24730EPSS 0.9%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug,…

  17. 7.5CVE-2022-25481ExploitEPSS 4.7%

    ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment…

  18. 9.8CVE-2022-23730EPSS 1.0%

    The public API error causes for the attacker to be able to bypass API access control.

  19. 3.3CVE-2022-25824EPSS 0.2%

    Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.

  20. 3.3CVE-2022-24930EPSS 0.4%

    An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to reset default app settings without a proper permission

  21. 7.8CVE-2021-42855EPSS 0.2%

    It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by…

  22. 6.5CVE-2022-26317EPSS 1.0%

    A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was ini…

  23. 9.8CVE-2022-26313EPSS 1.0%

    A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.

  24. 8.1CVE-2022-24309EPSS 0.6%

    A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set …

  25. 6.5CVE-2021-41543EPSS 0.7%

    A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information…

  26. 2.7CVE-2021-46270EPSS 0.7%

    JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation.

  27. 5.4CVE-2021-45074EPSS 0.6%

    JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.

  28. 8.8CVE-2022-0824ExploitEPSS 97%

    Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

  29. 4.3CVE-2021-24688EPSS 0.4%

    The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow att…

  30. 8.8CVE-2021-3967EPSS 0.8%

    Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

  31. 9.8CVE-2022-21706EPSS 1.2%

    Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organ…

  32. 5.3CVE-2020-14504EPSS 1.3%

    The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.

  33. 7.5CVE-2022-0732EPSS 2.5%

    The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

  34. 6.5CVE-2022-0731EPSS 1.0%

    Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

  35. 5.4CVE-2022-0727EPSS 0.7%

    Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

  36. 4.3CVE-2022-23981EPSS 0.6%

    The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

  37. 9.8CVE-2021-4201EPSS 2.0%

    Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access …

  38. 5.3CVE-2022-24924EPSS 0.7%

    An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission.

  39. 3.3CVE-2022-24923EPSS 0.2%

    Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.

  40. 3.3CVE-2022-23997EPSS 0.4%

    Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to disable theater mode without a proper permission.

  41. 3.3CVE-2022-23996EPSS 0.4%

    Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.

  42. 3.3CVE-2022-23995EPSS 0.4%

    Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.

  43. 3.3CVE-2022-23994EPSS 0.4%

    An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.

  44. 5.3CVE-2022-23433EPSS 0.6%

    Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(10) allows attackers to register reminders or execute exporeted activities remote…

  45. 7.5CVE-2020-13677EPSS 1.2%

    Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.

  46. 6.5CVE-2020-13676EPSS 0.8%

    The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installe…

  47. 9.8CVE-2020-13675EPSS 1.4%

    Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass th…

  48. 7.8CVE-2022-21825EPSS 0.2%

    An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.

  49. 5.5CVE-2022-21816EPSS 0.2%

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.

  50. 6.1CVE-2022-21813EPSS 0.2%

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can l…