CWE-284: Improper Access Control, page 148
Filter
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
What the weakness is: CWE-284 at MITRE
Ask an AI about CWE-284
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.3CVE-2021-21965EPSS 1.0%
A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious …
- 7.4CVE-2021-21964EPSS 0.7%
A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet …
- 6.5CVE-2022-0273EPSS 0.7%
Improper Access Control in Pypi calibreweb prior to 0.6.16.
- 8.8CVE-2021-40416EPSS 0.9%
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any lo…
- 6.5CVE-2021-40415EPSS 0.8%
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a specific case, the user permission will …
- 7.1CVE-2021-40414EPSS 0.8%
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAlarm API sets the movement detection parameters, giving the ability to set the sen…
- 7.1CVE-2021-40413EPSS 0.8%
An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of…
- 6.5CVE-2021-40404EPSS 1.2%
An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to tri…
- 5.3CVE-2022-0203EPSS 1.2%
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
- 8.8CVE-2022-0270EPSS 0.9%
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
- 9.8CVE-2021-23233EPSS 0.9%
Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform…
- 3.3CVE-2021-4016EPSS 0.2%
Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset…
- 5.3CVE-2022-21305EPSS 2.8%
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Editio…
- 5.3CVE-2022-21291EPSS 2.9%
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Editio…
- 6.7CVE-2021-34402EPSS 0.3%
NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial o…
- 7.8CVE-2021-34401EPSS 0.3%
NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial of service.
- 6.5CVE-2021-37864EPSS 0.6%
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly acc…
- 7.1CVE-2021-28507EPSS 0.7%
An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agen…
- 5.3CVE-2022-23134KEVExploitEPSS 94%
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Fro…
- 7.3CVE-2022-23132EPSS 0.8%
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the…
- 4.3CVE-2022-0170EPSS 0.7%
peertube is vulnerable to Improper Access Control
- 7.5CVE-2021-45034EPSS 2.3%
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE…
- 7.5CVE-2022-0133EPSS 1.3%
peertube is vulnerable to Improper Access Control
- 4.3CVE-2021-23173EPSS 0.6%
The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
- 6.5CVE-2021-4194EPSS 0.7%
bookstack is vulnerable to Improper Access Control
- 3.5CVE-2021-22567EPSS 0.6%
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible…
- 7.3CVE-2021-25991EPSS 0.8%
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
- 7.5CVE-2021-20050EPSS 0.9%
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
- 6.7CVE-2021-42808EPSS 0.2%
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
- 9.8CVE-2021-4119EPSS 27%
bookstack is vulnerable to Improper Access Control
- 9.8CVE-2021-36888ExploitEPSS 6.5%
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
- 4.3CVE-2021-24859EPSS 0.8%
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulne…
- 6.5CVE-2021-24845EPSS 1.0%
The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to c…
- 4.3CVE-2021-4089EPSS 0.7%
snipe-it is vulnerable to Improper Access Control
- 6.5CVE-2021-22565EPSS 0.4%
An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1…
- 8.8CVE-2021-42124EPSS 2.7%
An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.
- 6.8CVE-2021-35245EPSS 1.2%
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.
- 9.9CVE-2021-26334EPSS 1.2%
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
- 8.1CVE-2020-10627EPSS 0.5%
Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does no…
- 6.5CVE-2021-3992EPSS 1.1%
kimai2 is vulnerable to Improper Access Control
- 4.3CVE-2021-4026EPSS 0.9%
bookstack is vulnerable to Improper Access Control
- 4.3CVE-2021-42116EPSS 0.8%
Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher p…
- 7.5CVE-2021-36917EPSS 2.0%
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
- 10.0CVE-2021-3554EPSS 2.1%
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects…
- 4.9CVE-2021-40130EPSS 1.1%
A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restric…
- 8.1CVE-2021-36909EPSS 1.9%
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and ta…
- 5.4CVE-2021-42360EPSS 0.6%
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-proc…
- 7.1CVE-2021-35528EPSS 0.3%
Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing (CSB) allows an attacker to execute a modified signed Java Applet JAR file. …
- 4.3CVE-2021-24853EPSS 0.4%
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the red…
- 7.5CVE-2021-26338EPSS 0.9%
Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources.