← Back
CWE-284

5,090 CVEs • Abstraction: Pillar

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

JSON object

Loading...

CVEs (5,090)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Apple
1Macos
Apr 22, 2025
Nov 1, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
1Apple
5Ipados
Iphone OsMacos+2 more
Apr 22, 2025
Nov 1, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to access user-sensitive data.
1Apple
2Ipados
Iphone Os
May 6, 2025
Nov 1, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to record audio using a pair of connected AirPods.
1Apple
2Iphone Os
Macos
May 6, 2025
Nov 1, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to bypass Privacy preferences.
1Apple
1Macos
May 6, 2025
Nov 1, 2022
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data.
1Devolutions
1Remote Desktop Manager
May 5, 2025
Nov 1, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Man...Show more
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions. Show less
2Fedoraproject
Xen
2Fedora
Xen
May 5, 2025
Nov 1, 2022
N/A· v4
7.1 HIGH· v3
N/A· v2
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Acce...Show more
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.Show less
1Nextcloud
2Nextcloud Enterprise Server
Nextcloud Server
Nov 21, 2024
Oct 27, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of informat...Show more
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.Show less
1Tenable
1Nessus
May 7, 2025
Oct 25, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the disclosure of information on the scan target and/or the Nessus s...Show more
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the disclosure of information on the scan target and/or the Nessus scan to unauthorized parties able to reach the Nessus instance.Show less
1Goabode
1Iota All In One Security Kit Firmware
Nov 21, 2024
Oct 25, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution...Show more
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML payload to trigger this vulnerability.Show less
1Lannerinc
1Iac Ast2500a Firmware
Nov 21, 2024
Oct 24, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affect...Show more
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.Show less
1Lannerinc
1Iac Ast2500a Firmware
Nov 21, 2024
Oct 24, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an inpu...Show more
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.Show less
1Lannerinc
1Iac Ast2500a Firmware
Nov 21, 2024
Oct 24, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue...Show more
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.Show less
1Lannerinc
1Iac Ast2500a Firmware
Nov 21, 2024
Oct 24, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A stand...Show more
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.Show less
1Aethon
1Tug Home Base Server
Apr 17, 2025
Oct 21, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
1Aethon
1Tug Home Base Server
Apr 17, 2025
Oct 21, 2022
N/A· v4
8.2 HIGH· v3
N/A· v2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
1Netapp
1Clustered Data Ontap
May 9, 2025
Oct 19, 2022
N/A· v4
8.1 HIGH· v3
N/A· v2
Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allow an authenticated remote attacker to arbitrarily modify or delete WORM data pr...Show more
Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allow an authenticated remote attacker to arbitrarily modify or delete WORM data prior to the end of the retention period.Show less
1Jenkins
1Compuware Topaz For Total Test
May 8, 2025
Oct 19, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary fi...Show more
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.Show less
1Ocomon Project
1Ocomon
May 8, 2025
Oct 19, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover.
1Oracle
1Vm Virtualbox
Nov 21, 2024
Oct 18, 2022
N/A· v4
7.3 HIGH· v3
N/A· v2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with...Show more
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).Show less