CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- spring for graphql, vmware spring for graphql +1 moreSpring GraphQL Annotation Detection Vulnerability7.5 High
- fissionFission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape9.9 Critical
- fissionFission Container Executor Function PodSpec Injection Leading to Node Escape9.9 Critical
- fissionFission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover9.9 Critical
- fissionFission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook8.5 High
- fissionFission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook7.7 High
- fissionFission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance7.7 High
- splunk, splunk cloud platform, enterprise +2 moreImproper Access Control in Splunk Enterprise5.5 Medium
- kerberosmansour hulumiHULUMI-H5 bypass via decoy sibling resources targeting a different bucket8.5 High
- spring data rest, vmware spring data rest +1 moreSpring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys5.3 Medium
- spring data rest, vmware spring data rest +1 moreSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections7.5 High
- adobe dreamweaver, dreamweaver desktop +1 moreDreamweaver Desktop | Improper Access Control (CWE-284)8.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows BitLocker Security Feature Bypass Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreSecure Boot Security Feature Bypass Vulnerability7.9 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +3 more +5 moreWindows Administrator Protection Secure Feature Bypass Vulnerability7.8 High
- microsoft pc managerMicrosoft PC Manager Security Feature Bypass Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreSecure Boot Security Feature Bypass Vulnerability7.9 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreMicrosoft Kinect Elevation of Privilege Vulnerability7.8 High
- microsoft excel, excel for android, powerpoint for android +3 more +5 moreOffice for Android Spoofing Vulnerability7.1 High
- fortinet fortiportalA improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal...6.2 Medium
- huawei harmonyosUAF vulnerability in the package management module. Impact: Successful exploitation of this...5.1 Medium
- huawei harmonyosUAF vulnerability in the package management module. Impact: Successful exploitation of this...5.2 Medium
- spring hateoas, vmware spring hateoas +1 moreSpring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Security Filter Bypass in WebFlux Kotlin Router DSL4.8 Medium
- No product listedDcat-Admin User Setting upload editorMDUpload unrestricted upload5.1 Medium
- No product listedSEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.7.5 High
- No product listedInsecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from...8.1 High
- imvks786 student management systemimvks786 student_management_system Student Record add.php access control5.3 Medium
- cyber-iii student-management-systemKushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload6.9 Medium
- zilliztech deep-searcherzilliztech deep-searcher collection_router.py CollectionRouter.invoke access control5.3 Medium
- No product listedJeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure2.3 Low
- secureage catchpulseSecureAge CatchPulse IOCTL saappctl.sys information disclosure4.8 Medium
- erzhongxmu jeewmserzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure6.9 Medium
- buffalo open xdmod, ubccr xdmod +1 moreOpen XDMoD has Broken Access Control via Client-Controlled Session Variable5.3 Medium
- termixTermix Vulnerable to Arbitrary Command Execution via Session Hijacking9.0 Critical
- code-projects vehicle management systemcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload6.9 Medium
- vantage6vantage6 node has an Improper Access Control issue6.9 Medium
- nocodbNocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints6.9 Medium
- tittuvarghese collegemanagementsystemtittuvarghese CollegeManagementSystem Student Data Upload Endpoint upload_student_data.php unrestricted upload5.3 Medium
- widgetfactorylimited jce, joomlacontenteditor.net joomla content editor (jce) extension for joomla, widget factory joomla content editor +2 moreJoomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.510.0 Critical
- openai atlasOpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com...6.0 Medium
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53...4.3 Medium
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53...4.3 Medium
- google chromeInappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53...4.3 Medium
- google chromeInappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote...4.3 Medium
- google chromeInsufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53...4.3 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an...4.3 Medium
- google chromeInappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- Show moreLoading…