CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects daily expense manager, daily expense manager expense manager +1 morecode-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure6.9 Medium
- surecartSureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login6.5 Medium
- unknown embedpressEmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat5.3 Medium
- ibm observability with instana (agent)IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image9.6 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust6.5 Medium
- code-projects vehicle management systemcode-projects Vehicle Management System SQL Database Backup File vehicle_management.sql information disclosure6.9 Medium
- unknown ninja formsNinja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API5.9 Medium
- dolibarrDolibarr Legacy File Manager config.inc.php access control5.3 Medium
- lightstar smartit desktop managerLightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials8.7 High
- No product listedTrueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT...7.5 High
- No product listedAn issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to...9.8 Critical
- No product listedAn issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway...6.3 Medium
- No product listedA broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS...4.3 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload5.3 Medium
- 1hive gardens-v2Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes8.7 High
- No product listedILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload5.3 Medium
- cisco ios xr softwareCisco IOS XR Software Security Hardening Release: September 20269.8 Critical
- jenkins project saml pluginJenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity...8.8 High
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for...6.3 Medium
- kimaiKimai before 2.65.0 Authorization Bypass via Team Activity API5.3 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access6.6 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution8.8 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreUnauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX9.8 Critical
- arubanetworks fabric composerAuthenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API4.3 Medium
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API6.5 Medium
- rockwell automation dataedgeplatform datamosaix™ private cloudDataEdgePlatform DataMosaix™ Private Cloud8.7 High
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts5.3 Medium
- mozilla firefox, thunderbird +1 morePrivilege escalation in the WebDriver BiDi component8.8 High
- mozilla firefox, firefox mobile +1 morePrivilege escalation in Firefox for Android8.8 High
- wwbn avideoAVideo on_publish.php Missing Authentication Check via RTMP Callback8.8 High
- opennebulaLack of authorisation in OpenNebula by OpenNebula Systems8.7 High
- ash-project ashETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness5.9 Medium
- No product listedAn issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via...9.8 Critical
- No product listedA Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0....8.1 High
- No product listedIncorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu...9.8 Critical
- No product listedIncorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu...9.8 Critical
- No product listedIncorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015...7.5 High
- No product listedIncorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...7.5 High
- No product listedIncorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu...9.8 Critical
- No product listedIncorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu...9.8 Critical
- No product listedIncorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...9.8 Critical
- No product listedIncorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...5.3 Medium
- No product listedIncorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015...5.9 Medium
- No product listedIncorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015...5.3 Medium
- Show moreLoading…