CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft azure cosmos dbAzure Cosmos DB Remote Code Execution Vulnerability10.0 Critical
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree...7.5 High
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR5.9 Medium
- unknown appointment booking pluginLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel5.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization3.8 Low
- easyappointments easy appointmentsEasy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization3.8 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules7.3 High
- google chromeInsufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a...4.3 Medium
- google chromeInappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a...6.2 Medium
- google chromeInappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed...4.3 Medium
- google chromeInsufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an...4.3 Medium
- google chromeInappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72...4.3 Medium
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...4.3 Medium
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...6.5 Medium
- google chromeInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an...4.3 Medium
- google chromeInappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed...6.3 Medium
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Ruby SSE Session Poisoning8.3 High
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.210.0 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.210.0 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.29.2 Critical
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.07.5 High
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.210.0 Critical
- apache traffic serverApache Traffic Server: SNI to Host header matching policy is not properly enforced7.0 High
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsImproper access control vulnerability3.7 Low
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsImproper access control vulnerability3.7 Low
- goshs-labs goshsgoshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite9.1 Critical
- ibm sterling b2b integrator, sterling file gateway +1 moreImproper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway4.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure5.3 Medium
- xensysctl and platform-op locks open to abuse8.8 High
- unknown fluentcart a new era of ecommerceFluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR4.2 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...8.2 High
- apple macosAn access issue was addressed with improved access restrictions. This issue is fixed in macOS...8.6 High
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, safari +5 more +7 moreAn access issue was addressed with improved access restrictions. This issue is fixed in Safari 26...6.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed through improved state management. This issue is fixed in iOS 26.6 and...4.6 Medium
- apple macosA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in...7.1 High
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7...9.8 Critical
- apple macos, ios and ipados +1 moreA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8,...5.5 Medium
- apple macosA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...5.5 Medium
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...9.8 Critical
- apple macos, ios and ipados +1 moreA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...9.8 Critical
- ghost robotics vision 60Multiple vulnerabilities in Ghost Robotics' Vision 607.7 High
- codename065 download managerWordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key7.5 High
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer...9.8 Critical
- mf-yang openclaw-cnmf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure5.3 Medium
- Show moreLoading…