CWE-284
5,081 CVEs • Abstraction: Pillar
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVEs (5,081)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). |
1Redhat 9Enterprise Linux Enterprise Linux DesktopEnterprise Linux Server+6 moreNov 21, 2024 Aug 2, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain....Show more |
1Redhat 9Enterprise Linux Enterprise Linux DesktopEnterprise Linux Server+6 moreNov 21, 2024 Aug 2, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt wi...Show more |
1Redhat 9Enterprise Linux Enterprise Linux DesktopEnterprise Linux Server+6 moreNov 21, 2024 Aug 2, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state fil...Show more |
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). |
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
2Redhat Theforeman2Foreman SatelliteNov 21, 2024 Aug 1, 2019 N/A· v4 7.4 HIGH· v3 6.5 MEDIUM· v2 It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access reso...Show more |
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment. |
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |