CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM...9.8 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...8.8 High
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM...8.8 High
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component:...8.7 High
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.9 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...8.6 High
- oracle general ledgerVulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component:...7.1 High
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...8.1 High
- oracle mysql clusterVulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). ...8.2 High
- oracle hospitality simphonyVulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications...7.5 High
- oracle corporation hyperion financial reporting, oracle hyperion financial management +1 moreVulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component:...7.5 High
- frangoteam fuxaFUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup2.0 Low
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity6.5 Medium
- magicmirrororg magicmirrorMagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions2.3 Low
- goauthentik authentikauthentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView8.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.25.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.25.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.25.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.25.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.28.5 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Add-ons Manager component9.8 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the WebExtensions component8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics: CanvasWebGL component7.5 High
- No product listedOpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload5.3 Medium
- No product listedAn incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated...9.8 Critical
- orange view limited dualsafe password manager & digital vault extensionOrange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure2.3 Low
- No product listedAn issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute...9.8 Critical
- No product listedMahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via...9.8 Critical
- shahjada premium packagesPremium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request6.5 Medium
- spacex starlink router gen 3SpaceX Starlink Router Gen 3 gRPC Management get_status access control5.3 Medium
- dell ecsECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload5.3 Medium
- microsoft malware protection engineMicrosoft Defender Elevation of Privilege Vulnerability7.8 High
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.115.1 Medium
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload5.1 Medium
- webkul bagistoWebkul Bagisto Customer Search search information disclosure5.1 Medium
- webkul bagistoWebkul Bagisto Customer Item Deletion Endpoint access control5.1 Medium
- filebrowserFile Browser before 2.63.20 Privilege Escalation via Proxy Authentication8.7 High
- freepbx backupFreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module8.6 High
- gitea open source git serverTwo SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)9.1 Critical
- gitea open source git serverEmail Management API Bypasses ManageCredentials Feature Restrictions5.4 Medium
- priority portal generator addon to priority erp (developed by soft solutions)Priority - CWE-284: Improper Access Control8.6 High
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-284: Improper Access Control8.2 High
- unknown food menuTLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification5.3 Medium
- ibm informix dynamic serverIBM Informix Dynamic Server Privilege Escalation Vulnerability in oninit Utility7.8 High
- dell display and peripheral manager (ddpm windows), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an...7.8 High
- dell display and peripheral manager (ddpm windows), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper...7.8 High
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.06.3 Medium
- tabaoca.org cotton cloud extension for joomlaJoomla Extension - tabaoca.org - Improper ACL checks allow file operations in Cotton Cloud < 2.0.25.3 Medium
- tabaoca.org cotton cloud extension for joomlaJoomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud < 2.0.26.9 Medium
- subratamal wallet for woocommerceTeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up9.1 Critical
- Show moreLoading…