CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list2.7 Low
- unknown better paymentBetter Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation5.3 Medium
- therealsain pixtreamtheRealSain Pixtream post_upload.php unrestricted upload5.3 Medium
- anirbandutta9 college-notes-galleryanirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload5.3 Medium
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)9.8 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools6.5 Medium
- rti connext professionalInteger Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.7.3 High
- tauri tauri-plugin-updaterTauri framework v2 malicious downgrade via allow_downgrades from frontend code6.8 Medium
- netdataNetdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK6.5 Medium
- projectdiscovery nucleiNuclei: Local File Read via Workflow File-Protocol Gate Bypass5.5 Medium
- projectdiscovery nucleiNuclei: Local File Read via MySQL Client Sandbox Bypass5.3 Medium
- josephchuks php-file-manager-with-code-editorJosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload6.9 Medium
- josephchuks php-file-manager-with-code-editorJosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload6.9 Medium
- No product listedA horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can...8.8 High
- warp-tech warpgateWarpgate: API tokens bypass the user's allowed_ip_ranges restriction4.3 Medium
- devolutions serverFile owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files...6.5 Medium
- mispMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport6.4 Medium
- scadabrScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure6.9 Medium
- No product listedAn improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can...7.6 High
- d-link dir-x1860zD-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure5.3 Medium
- d-link dir-x1860, dir-x1860z +1 moreD-Link DIR-X1860/DIR-X1860Z routerd ubus access control8.7 High
- aiyiyi121 sxdevopsaiyiyi121 SxDevOps settings.py information disclosure6.9 Medium
- unknown tripzzyTripzzy < 1.5.1 - Unauthenticated Booking Data Tampering5.3 Medium
- unknown tripzzyTripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion7.5 High
- unknown wpgraphql smart cacheWPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting6.5 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control6.5 Medium
- stacklok toolhive, toolhive-studio +1 moreToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement8.8 High
- red hat enterprise linux 10, enterprise linux 9 +1 moreXdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks3.2 Low
- patriksimek vm2vm2 3.11.8 Sandbox Escape via crypto.setFips6.9 Medium
- No product listedSveltyCMS User Attribute Update Endpoint +server.ts access control5.3 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.5.0 Medium
- unknown clean loginClean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- unknown filter galleryFilter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check7.1 High
- easyappointments easy appointmentsEasy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token4.8 Medium
- unknown easy form builder by whitestudioEasy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion5.3 Medium
- devolutions serverThe Photos app's filter-based "smart albums" build their file listing using the search...6.5 Medium
- nextcloud deckThe Deck config API allows authenticated users to set board-scoped configuration keys for...4.3 Medium
- nextcloud team foldersA vulnerability in the team folders (formerly group folders) app when used in combination with...6.5 Medium
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability10.0 Critical
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System drug_recommendor.sql information disclosure6.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests3.7 Low
- patriksimek vm2vm2 before 3.11.7 Denylist Bypass via fs/promises8.4 High
- patriksimek vm2vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix9.4 Critical
- acer system monitoringImproper Access control Vulnerability in NitroSense and PredatorSense Software7.4 High
- acer system monitoringUnauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software7.4 High
- acer agent serivcePrivilege Escalation Vulnerability in NitroSense and PredatorSense Software7.4 High
- @fastify/static@fastify/static vulnerable to route guard bypass via path case-folding5.3 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure4.9 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch5.3 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software +1 moreCIsco FTD Bypass Access List5.3 Medium
- Show moreLoading…