← Back
CWE-284

7,483 CVEs • Abstraction: Pillar

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

JSON object

Loading...

CVEs (7,483)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-20951
1Oracle
1Customer Interaction History
Jun 17, 2026
Feb 17, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows u...Show more
Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Interaction History, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).Show less
CVE-2024-20931
1Oracle
1Weblogic Server
Jun 17, 2026
Feb 17, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthentic...Show more
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).Show less
CVE-2024-20929
1Oracle
1Application Object Library
Jun 17, 2026
Feb 17, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unau...Show more
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).Show less
CVE-2024-20927
1Oracle
1Weblogic Server
Jun 17, 2026
Feb 17, 2024
N/A· v4
8.6 HIGH· v3
N/A· v2
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthentic...Show more
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).Show less
CVE-2024-20911
1Oracle
1Audit Vault And Database Firewall
Jun 17, 2026
Feb 17, 2024
N/A· v4
2.6 LOW· v3
N/A· v2
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vulnerability allows high privileged attacker with network access...Show more
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Audit Vault and Database Firewall, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Audit Vault and Database Firewall accessible data. CVSS 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N).Show less
CVE-2024-0036
1Google
1Android
Jun 17, 2026
Feb 16, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local es...Show more
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Show less
CVE-2024-0032
1Google
1Android
Jun 17, 2026
Feb 16, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges need...Show more
In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Show less
CVE-2023-39244
1Dell
1Enterprise Storage Integrator For Sap Landscape Management
Jun 17, 2026
Feb 15, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by...Show more
DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials.Show less
CVE-2024-24386
1Vitalpbx
1Vitalpbx
Jun 17, 2026
Feb 15, 2024
N/A· v4
7.2 HIGH· v3
N/A· v2
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
CVE-2024-24300
14ipnet
1Eap 767 Firmware
Jun 17, 2026
Feb 14, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged.
CVE-2023-40161
1Intel
1Unite
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-39941
1Intel
1System Usage Report For Gameplay
Jun 17, 2026
Feb 14, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2023-39432
1Intel
1Ethernet Adapter Complete Driver
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control element in some Intel(R) Ethernet tools and driver install software, before versions 28.2, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-39425
1Intel
1Driver & Support Assistant
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-38561
1Intel
1Extreme Tuning Utility
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-35121
1Intel
16Advisor
Cluster CheckerDistribution For Python+13 more
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privil...Show more
Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local access. Show less
CVE-2023-35062
1Intel
1Driver & Support Assistant
Jun 17, 2026
Feb 14, 2024
N/A· v4
6.7 MEDIUM· v3
N/A· v2
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2023-33875
1Intel
2Killer
Proset/wireless
Jun 17, 2026
Feb 14, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via local access..
CVE-2023-32647
1Intel
1Extreme Tuning Utility
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-31271
1Intel
1Virtual Raid On Cpu
Jun 17, 2026
Feb 14, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
Improper access control in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access.