CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- oracle mysql cluster, mysql server +1 moreVulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL)...4.4 Medium
- oracle application testing suiteVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13...9.8 Critical
- oracle public sector financials, oracle corporation public sector financials (international) +1 moreVulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business...8.0 High
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.3 Medium
- oracle application testing suiteVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13...9.8 Critical
- oracle application testing suiteVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13...9.8 Critical
- oracle application testing suiteVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13...7.5 High
- oracle commerce service centerVulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component:...6.1 Medium
- oracle retail xstore point of serviceVulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications ...4.3 Medium
- oracle retail xstore point of serviceVulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications ...3.3 Low
- gitea open source git serverGitea SSH Key Parser Denial of Service6.2 Medium
- gitea open source git serverRepository Visibility Manipulation via Git Push Options7.1 High
- gitea open source git serverLocal File Inclusion via file:// URI in Migration Restore4.4 Medium
- gitea open source git serverNull Pointer Dereference in AddTime API Causes Authenticated Denial of Service2.7 Low
- gitea open source git serverREST API exposes organization membership of private organizations to public7.5 High
- gitea open source git serverPrivilege Escalation via Access Token Scope Escalation in API9.8 Critical
- gitea open source git serverDenial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload6.2 Medium
- gitea open source git serverPrivate Repository Existence Disclosure via go-get Meta Endpoint5.3 Medium
- gitea open source git serverUnbounded Arch package file metadata can cause resource amplification in Gitea package uploads4.3 Medium
- gitea open source git serverGitea Remember-Me Token Theft Not Invalidating Attacker Session9.1 Critical
- gitea open source git serverBranch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag8.1 High
- giteaGitea private repository metadata disclosure after access revocation4.3 Medium
- gitea open source git serverWebhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)6.8 Medium
- zsadmin2025 zs-adminzsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload5.3 Medium
- eclipse hawkbit, eclipse foundation eclipse-hawkbit/hawkbit +1 morePrivilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration4.3 Medium
- solarwinds serv-uSolarWinds Serv-U Broken Access Control Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Privilege Escalation Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Privilege Escalation Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Remote Code Execution Vulnerability9.1 Critical
- d-link dns-320D-Link DNS-320 multi_uploadify.php unrestricted upload6.9 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Service Workers component9.8 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking component9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Workers component8.8 High
- d-link dns-320D-Link DNS-320 multi_uploadify.php unrestricted upload6.9 Medium
- d-link dns-320D-Link DNS-320 save_ajax.php unrestricted upload6.9 Medium
- d-link dns-320D-Link DNS-320 uploadify.php unrestricted upload6.9 Medium
- d-link dns-320D-Link DNS-320 uploadify.php unrestricted upload6.9 Medium
- No product listedIn Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password...9.8 Critical
- d-link dns-320D-Link DNS-320 upload.php unrestricted upload6.9 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM upload.jsp unrestricted upload6.9 Medium
- pdovhomilja nextcrm-appNextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog7.1 High
- pdovhomilja nextcrm-appNextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering7.6 High
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.29.1 Critical
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.18.7 High
- unknown payplus payment gatewayPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload5.1 Medium
- zevorn rt-clawzevorn rt-claw http_request net.c claw_net_post information disclosure6.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation4.9 Medium
- txone networks safeportagent, stellarprotect +1 moreImproper Access Control vulnerability in the Removable Media Validation function of TXOne...6.7 Medium
- No product listedIncorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8...6.5 Medium
- Show moreLoading…