cve.bz

CWE-284: Improper Access Control, page 155

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2015-9291EPSS 1.3%

    cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).

  2. 4.3CVE-2018-20890EPSS 0.6%

    cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

  3. 7.4CVE-2014-8183EPSS 0.7%

    It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other orga…

  4. 4.3CVE-2019-10189EPSS 0.9%

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.

  5. 4.3CVE-2019-10188EPSS 0.9%

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.

  6. 4.3CVE-2019-10187EPSS 0.9%

    A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.

  7. 7.8CVE-2019-10161EPSS 0.5%

    It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd proces…

  8. 2.4CVE-2019-5452EPSS 0.4%

    Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.

  9. 8.8CVE-2019-10138EPSS 1.0%

    A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA token…

  10. 4.3CVE-2019-10130EPSS 1.1%

    A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, suc…

  11. 7.5CVE-2017-18380EPSS 1.1%

    edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.

  12. 9.8CVE-2019-9884EPSS 3.0%

    eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

  13. 7.8CVE-2018-13896EPSS 0.2%

    XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_SEC stage.. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer El…

  14. 5.4CVE-2019-3794EPSS 1.1%

    Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

  15. 9.8CVE-2019-10970EPSS 4.6%

    In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Disp…

  16. 7.8CVE-2019-1010316EPSS 0.3%

    pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is: 0.4.

  17. 7.5CVE-2019-9886EPSS 2.2%

    Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

  18. 7.2CVE-2018-19588EPSS 1.7%

    Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.

  19. 5.4CVE-2018-17151EPSS 0.7%

    Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.

  20. 8.1CVE-2018-11744EPSS 0.9%

    Cloudera Manager through 5.15 has Incorrect Access Control.

  21. 8.1CVE-2018-19576EPSS 1.2%

    GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the iss…

  22. 5.3CVE-2018-19577EPSS 2.1%

    Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential i…

  23. 6.5CVE-2018-19496EPSS 0.8%

    An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privi…

  24. 4.3CVE-2018-19494EPSS 0.8%

    An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names.

  25. 5.9CVE-2018-14833EPSS 1.2%

    Intuit Lacerte 2017 has Incorrect Access Control.

  26. 6.5CVE-2019-1890EPSS 0.6%

    A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, adjacent attacker to bypass security va…

  27. 8.1CVE-2018-14859EPSS 0.9%

    Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure tok…

  28. 6.5CVE-2018-14864EPSS 1.2%

    Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.

  29. 8.1CVE-2018-14863EPSS 0.9%

    Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.

  30. 8.8CVE-2019-13028EPSS 3.7%

    An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML …

  31. 7.1CVE-2019-10964EPSS 1.2%

    Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not pro…

  32. 6.5CVE-2019-10175EPSS 0.9%

    A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the s…

  33. 9.8CVE-2018-14885EPSS 2.2%

    Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary passwor…

  34. 5.3CVE-2018-14867EPSS 1.4%

    Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted pa…

  35. 5.3CVE-2019-1622ExploitEPSS 79%

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improp…

  36. 9.8CVE-2019-1619ExploitEPSS 83%

    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an a…

  37. 7.2CVE-2018-16553EPSS 2.5%

    In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin.

  38. 9.8CVE-2019-2729ExploitEPSS 89%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthe…

  39. 9.8CVE-2018-17148EPSS 3.7%

    An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing …

  40. 6.5CVE-2017-10721EPSS 1.6%

    Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users…

  41. 6.5CVE-2018-18958EPSS 0.6%

    OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.

  42. 5.3CVE-2019-10962EPSS 1.7%

    BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Work…

  43. 7.1CVE-2019-10925EPSS 2.2%

    A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be e…

  44. 7.5CVE-2018-10691EPSS 2.4%

    An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or…

  45. 5.9CVE-2018-5264EPSS 1.5%

    Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/def…

  46. 8.0CVE-2019-3895EPSS 1.6%

    An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote atta…

  47. 8.1CVE-2019-3567EPSS 1.7%

    In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery …

  48. 8.8CVE-2018-5406ExploitEPSS 12%

    The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perfor…

  49. 7.1CVE-2019-11896EPSS 0.7%

    A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to e…

  50. 5.3CVE-2019-11895EPSS 1.0%

    A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In…