CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- tenable, inc. plugin feedIncorrect Authorization6.0 Medium
- servicenow ai platformSandbox Escape via Table Rotation in ServiceNow AI Platform9.4 Critical
- servicenow ai platformDomain Separation Bypass in ServiceNow AI Platform5.3 Medium
- ubiquiti inc wifiman desktop for macosA malicious actor with local access and high privileges could exploit an Improper Access Control...6.7 Medium
- progress software ws ftp serverImproper Access Control of Web Admin Console in Progress WS_FTP Server8.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.5 High
- bplugins video player for youtubeYT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax3.8 Low
- No product listedTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in...8.8 High
- No product listedSuperAGI v0.0.14 contains an improper access control vulnerability in...8.1 High
- No product listedSuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller...6.5 Medium
- No product listedInsecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600...7.5 High
- No product listedInsecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown...6.5 Medium
- No product listedInsecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers...9.1 Critical
- No product listedInsecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized...9.1 Critical
- No product listedInsecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows...9.1 Critical
- No product listedInsecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another...7.5 High
- No product listedInsecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write...9.1 Critical
- maotoumao musicfreedesktopmaotoumao MusicFreeDesktop Request Forwarder information disclosure5.3 Medium
- vitejs viteVite: `server.fs.deny` bypassed with queries6.9 Medium
- chromedevtools chrome-devtools-mcpInsufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0...4.4 Medium
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.8.6 High
- unknown wp rosterWP Roster < 2.35 - Unauthenticated Roster Member Deletion5.3 Medium
- unknown court reservationCourt Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion5.3 Medium
- unknown casso flowCasso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation5.3 Medium
- google chromeImproper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote...9.3 Critical
- google chromeImproper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...4.3 Medium
- oretnom23 php-travel-agency-systemoretnom23 php-travel-agency-system employee_insert.php unrestricted upload6.9 Medium
- nextcloud tablesThe user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.4.6 Medium
- devolutions serverWhen a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle…4.3 Medium
- nextcloud files confidentialA user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.4.3 Medium
- nextcloud collectivesA public shared collective always allowed recipients of the link to create pages.3.5 Low
- nextcloud richdocumentsA missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.3.5 Low
- nagios host, teamviewer full client, remote management - monitoring +2 moreLocal privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring7.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: UI Events & Focus Handling component8.8 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Service Workers component8.1 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release...6.5 Medium
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.29.3 Critical
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System add_food.php unrestricted upload5.1 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure6.9 Medium
- totolink a950rgTOTOLINK A950RG global.so getLanguageCfg information disclosure6.9 Medium
- apple ipados, macos, visionos +2 more +4 moreAn access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and...7.5 High
- apple macosAn access issue was addressed with improved access restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreAn access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7...5.1 Medium
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...8.2 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- apple macosThis issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,...3.3 Low
- apple ipados, macos, visionos +2 more +4 moreThis issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7...6.1 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2...8.4 High
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...7.4 High
- Show moreLoading…