cve.bz

CWE-284: Improper Access Control, page 160

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2016-6342EPSS 1.0%

    elog 3.1.1 allows remote attackers to post data as any username in the logbook.

  2. 7.5CVE-2016-5414EPSS 1.0%

    FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.

  3. 8.4CVE-2016-4383EPSS 2.7%

    The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.

  4. 5.5CVE-2015-8697EPSS 0.3%

    stalin 0.11-5 allows local users to write to arbitrary files.

  5. 5.5CVE-2015-7898ExploitEPSS 0.8%

    Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).

  6. 5.5CVE-2015-7895ExploitEPSS 1.1%

    Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).

  7. 5.5CVE-2015-3840EPSS 0.2%

    The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS" permission.

  8. 6.8CVE-2017-7918ExploitEPSS 6.7%

    An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack p…

  9. 5.5CVE-2016-10335EPSS 0.5%

    In all Android releases from CAF using the Linux kernel, libtomcrypt was updated.

  10. 5.5CVE-2016-10334EPSS 0.5%

    In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten.

  11. 5.5CVE-2016-10333EPSS 0.5%

    In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS.

  12. 7.8CVE-2015-9029EPSS 0.6%

    In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory.

  13. 5.5CVE-2015-9024EPSS 0.5%

    In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications.

  14. 5.5CVE-2015-9021EPSS 0.5%

    In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled.

  15. 7.8CVE-2014-9961EPSS 0.6%

    In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection.

  16. 7.5CVE-2016-7833EPSS 1.8%

    Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspecified vectors.

  17. 8.8CVE-2016-7824EPSS 1.6%

    Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via unspecified vectors.

  18. 8.8CVE-2016-7811EPSS 0.9%

    Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations via unspecified vectors.

  19. 7.5CVE-2016-7807EPSS 2.0%

    I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors.

  20. 4.3CVE-2016-7801EPSS 1.1%

    Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.

  21. 4.3CVE-2016-4910EPSS 1.1%

    Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.

  22. 4.3CVE-2016-4908EPSS 1.1%

    Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.

  23. 8.1CVE-2016-6098EPSS 1.0%

    IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

  24. 10.0CVE-2015-2692EPSS 2.1%

    AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.

  25. 7.5CVE-2016-3112EPSS 2.2%

    client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by r…

  26. 5.5CVE-2016-3107EPSS 0.2%

    The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

  27. 5.3CVE-2015-3295EPSS 1.3%

    markdown-it before 4.1.0 does not block data: URLs.

  28. 5.5CVE-2016-6089EPSS 0.3%

    IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926.

  29. 7.5CVE-2016-0768EPSS 1.4%

    PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.

  30. 7.8CVE-2015-9006EPSS 0.5%

    In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.

  31. 8.8CVE-2017-8438EPSS 1.0%

    Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a templ…

  32. 7.3CVE-2017-6016EPSS 0.3%

    An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affected: Versions 4.1 and prior versions released before January 20, 2017. An Improp…

  33. 7.8CVE-2016-10237EPSS 0.6%

    If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF using the Linux kernel, the TA would not detect an issue and it would be treated …

  34. 7.5CVE-2016-10370EPSS 1.1%

    An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessari…

  35. 7.8CVE-2016-10369EPSS 0.3%

    unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

  36. 7.5CVE-2016-7054ExploitEPSS 32%

    In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyon…

  37. 8.4CVE-2016-9976EPSS 1.7%

    IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerabl…

  38. 7.5CVE-2016-2930EPSS 1.6%

    IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512.

  39. 7.3CVE-2016-8588EPSS 2.2%

    The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.

  40. 7.3CVE-2016-8587EPSS 2.5%

    dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn…

  41. 9.8CVE-2016-8584EPSS 5.6%

    Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.

  42. 2.8CVE-2016-5551EPSS 0.4%

    Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected is 4.3. Easily "exploitable" vulnerability allows unauthenticated attacker with…

  43. 8.8CVE-2015-0104ExploitEPSS 6.8%

    IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7…

  44. 8.8CVE-2016-2433EPSS 0.7%

    The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context of the kernel.

  45. 8.1CVE-2016-1518EPSS 1.7%

    The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain…

  46. 4.3CVE-2016-3733EPSS 1.2%

    The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

  47. 6.5CVE-2016-3729EPSS 1.3%

    The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.

  48. 8.1CVE-2016-4850EPSS 2.2%

    LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.

  49. 4.3CVE-2016-1220EPSS 1.0%

    Cybozu Garoon before 4.2.2 does not properly restrict access.

  50. 6.8CVE-2016-6338EPSS 0.5%

    ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selection…