Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (7,464)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-2088 1Smartics 1Smartics Jun 17, 2026 Jun 27, 2022 N/A· v4 4.9 MEDIUM· v3 6.8 MEDIUM· v2 An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
CVE-2020-9754 1Navercorp 1Whale Jun 17, 2026 Jun 27, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
CVE-2022-2103 1Secheron 1Sepcos Control And Protection Relay Firmware Jun 17, 2026 Jun 24, 2022 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.
CVE-2022-1521 1Illumina 1Local Run Manager Jun 17, 2026 Jun 24, 2022 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
CVE-2017-20066 1Adminer Login Project 1Adminer Login Nov 21, 2024 Jun 20, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the...Show more A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.Show less
CVE-2022-27511 1Citrix 1Application Delivery Management Jun 17, 2026 Jun 16, 2022 N/A· v4 8.1 HIGH· v3 7.8 HIGH· v2 Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the defau...Show more Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.Show less
CVE-2022-28612 1Custom Popup Builder Project 1Custom Popup Builder Jun 17, 2026 Jun 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
CVE-2022-32158 1Splunk 1Splunk Jun 17, 2026 Jun 15, 2022 N/A· v4 10.0 CRITICAL· v3 7.5 HIGH· v2 Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal...Show more Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.Show less
CVE-2022-1958 1Filecloud 1Filecloud Jun 17, 2026 Jun 15, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack r...Show more A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960.Show less
CVE-2022-32256 1Siemens 1Sinema Remote Connect Server Jun 17, 2026 Jun 14, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to...Show more A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information.Show less
CVE-2022-32255 1Siemens 1Sinema Remote Connect Server Jun 17, 2026 Jun 14, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to...Show more A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information.Show less
CVE-2022-31055 1Google 1Kctf Jun 17, 2026 Jun 13, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1...Show more kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark them as `public: false` and use `kctf chal debug port-forward` to connect.Show less
CVE-2022-1659 1Artbees 1Jupiterx Jun 17, 2026 Jun 13, 2022 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending...Show more Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.Show less
CVE-2022-1658 1Artbees 1Jupiter Jun 17, 2026 Jun 13, 2022 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/...Show more Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site.Show less
CVE-2022-1656 1Artbees 2Jupiter X Core Jupiterx Jun 17, 2026 Jun 13, 2022 N/A· v4 5.4 MEDIUM· v3 5.5 MEDIUM· v2 Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_a...Show more Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key.Show less
CVE-2022-30745 1Samsung 1Quick Share Jun 17, 2026 Jun 7, 2022 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share.
CVE-2022-30715 1Google 1Android Jun 17, 2026 Jun 7, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window.
CVE-2022-31024 1Nextcloud 1Richdocuments Jun 17, 2026 Jun 2, 2022 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them...Show more richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.Show less
CVE-2022-1261 1Honeywell 1Matrikon Opc Server Jun 17, 2026 May 26, 2022 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute opera...Show more Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute operating system processes with system-level privileges.Show less
CVE-2021-41834 1Jfrog 1Artifactory Jun 17, 2026 May 23, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory depl...Show more JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.Show less

Previous 1...297298299...374 Next