cve.bz

CWE-284: Improper Access Control, page 154

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2019-15998EPSS 0.7%

    A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected…

  2. 4.4CVE-2019-15967EPSS 0.3%

    A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence…

  3. 8.8CVE-2019-15956EPSS 1.0%

    A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability…

  4. 9.8CVE-2019-5644EPSS 1.3%

    Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a us…

  5. 5.3CVE-2019-5643EPSS 0.9%

    Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and…

  6. 9.8CVE-2019-5617EPSS 1.3%

    Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any a…

  7. 6.5CVE-2019-6144EPSS 1.0%

    This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection.

  8. 9.8CVE-2019-15260EPSS 3.0%

    A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access contro…

  9. 4.9CVE-2019-14838EPSS 1.1%

    A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

  10. 9.8CVE-2019-9531EPSS 2.5%

    The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT)…

  11. 5.5CVE-2019-9530EPSS 0.4%

    The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download a…

  12. 5.5CVE-2019-9529EPSS 0.3%

    The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the …

  13. 5.5CVE-2019-3653EPSS 0.2%

    Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.

  14. 6.7CVE-2019-12670EPSS 0.3%

    A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is due to insufficien…

  15. 8.8CVE-2019-12648EPSS 2.4%

    A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability i…

  16. 9.8CVE-2019-15068EPSS 1.9%

    A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication.

  17. 8.8CVE-2019-6810EPSS 1.7%

    CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol.

  18. 4.3CVE-2019-13919EPSS 0.8%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user can also be accessed by a non-privileged user. The security vulnerability could b…

  19. 7.5CVE-2019-11899EPSS 1.1%

    An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client installations need to be authorized by the …

  20. 9.8CVE-2019-13656EPSS 5.8%

    An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.

  21. 5.3CVE-2018-15513EPSS 1.0%

    Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor role.

  22. 9.8CVE-2018-21007EPSS 2.0%

    The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.

  23. 7.5CVE-2015-9337EPSS 1.3%

    The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

  24. 7.5CVE-2019-12627EPSS 1.2%

    A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to in…

  25. 7.5CVE-2019-5036EPSS 0.5%

    An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resultin…

  26. 9.8CVE-2017-18543EPSS 1.8%

    The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.

  27. 8.8CVE-2018-20957EPSS 1.0%

    The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.

  28. 8.8CVE-2016-10802EPSS 1.2%

    cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

  29. 5.5CVE-2016-10799EPSS 0.3%

    cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).

  30. 8.8CVE-2016-10792EPSS 1.2%

    cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).

  31. 4.4CVE-2017-18457EPSS 0.4%

    cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

  32. 3.3CVE-2017-18421EPSS 0.3%

    cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

  33. 9.8CVE-2019-10938EPSS 1.5%

    A vulnerability has been identified in SIPROTEC 5 devices with CPU variants CP200 (All versions < V7.59), SIPROTEC 5 devices with CPU variants CP300 and CP100 (All versions < V8.01), Siemens Power Meters Series 9410 (All versions < V2.2.1)…

  34. 5.5CVE-2017-18416EPSS 0.3%

    cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).

  35. 3.1CVE-2017-18404EPSS 0.4%

    cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).

  36. 6.3CVE-2017-18403EPSS 0.8%

    cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

  37. 7.8CVE-2019-10168EPSS 0.5%

    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libv…

  38. 7.8CVE-2019-10167EPSS 0.5%

    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that pro…

  39. 7.8CVE-2019-10166EPSS 0.5%

    It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed sa…

  40. 5.5CVE-2017-18385EPSS 0.3%

    cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).

  41. 3.8CVE-2017-18384EPSS 0.3%

    cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).

  42. 8.8CVE-2016-10820EPSS 1.3%

    cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).

  43. 2.7CVE-2018-20938EPSS 0.6%

    cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

  44. 8.1CVE-2016-10830EPSS 1.0%

    cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).

  45. 6.5CVE-2018-20930EPSS 0.7%

    cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

  46. 6.5CVE-2016-10838EPSS 1.1%

    cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).

  47. 8.1CVE-2016-10860EPSS 1.0%

    cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

  48. 6.5CVE-2016-10857EPSS 1.0%

    cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

  49. 6.5CVE-2016-10856EPSS 1.0%

    cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

  50. 6.5CVE-2016-10852EPSS 1.0%

    cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).