Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (8,875)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-23173 1Philips 1Engage Jun 17, 2026 Jan 10, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
CVE-2021-4194 1Bookstackapp 1Bookstack Jun 17, 2026 Jan 6, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 bookstack is vulnerable to Improper Access Control
CVE-2021-22567 1Dart 1Dart Software Development Kit Jun 17, 2026 Jan 5, 2022 N/A· v4 3.5 LOW· v3 3.5 LOW· v2 Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a sourc...Show more Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways.Show less
CVE-2021-25991 1If Me 1Ifme Jun 17, 2026 Dec 29, 2021 N/A· v4 7.3 HIGH· v3 4.9 MEDIUM· v2 In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access...Show more In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.Show less
CVE-2021-20050 1Sonicwall 6Sma 100 Firmware Sma 200 FirmwareSma 210 Firmware+3 more Jun 17, 2026 Dec 23, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
CVE-2021-42808 1Thalesgroup 1Sentinel Protection Installer Jun 17, 2026 Dec 20, 2021 N/A· v4 6.7 MEDIUM· v3 7.2 HIGH· v2 Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
CVE-2021-4119 1Bookstackapp 1Bookstack Jun 17, 2026 Dec 15, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 bookstack is vulnerable to Improper Access Control
CVE-2021-36888 1Blocksera 1Image Hover Effects Jun 17, 2026 Dec 15, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
CVE-2021-24859 1User Meta Shortcodes Project 1User Meta Shortcodes Jun 17, 2026 Dec 13, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes th...Show more The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashesShow less
CVE-2021-24845 1Improved Include Page Project 1Improved Include Page Jun 17, 2026 Dec 13, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor c...Show more The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.Show less
CVE-2021-4089 1Snipeitapp 1Snipe It Jun 17, 2026 Dec 10, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 snipe-it is vulnerable to Improper Access Control
CVE-2021-22565 1Google 1Exposure Notification Verification Server Jun 17, 2026 Dec 9, 2021 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notifica...Show more An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.Show less
CVE-2021-42124 1Ivanti 1Avalanche Jun 17, 2026 Dec 7, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.
CVE-2021-35245 1Solarwinds 1Serv U Jun 17, 2026 Dec 6, 2021 N/A· v4 6.8 MEDIUM· v3 6.8 MEDIUM· v2 When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.
CVE-2021-26334 1Amd 1Amd Uprof Jun 17, 2026 Dec 1, 2021 N/A· v4 9.9 CRITICAL· v3 9.0 HIGH· v2 The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
CVE-2020-10627 1Insulet 1Omnipod Insulin Management System Firmware Jun 17, 2026 Dec 1, 2021 N/A· v4 8.1 HIGH· v3 4.8 MEDIUM· v2 Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communicati...Show more Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with access to one of the affected insulin pump models may be able to modify and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.Show less
CVE-2021-3992 1Kimai2 Project 1Kimai2 Jun 17, 2026 Dec 1, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 kimai2 is vulnerable to Improper Access Control
CVE-2021-4026 1Bookstackapp 1Bookstack Jun 17, 2026 Nov 30, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 bookstack is vulnerable to Improper Access Control
CVE-2021-42116 1Businessdnasolutions 1Topease Jun 17, 2026 Nov 30, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functio...Show more Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the front-end source code or other means.Show less
CVE-2021-36917 1Wpwave 1Hide My Wp Jun 17, 2026 Nov 24, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.

Previous 1...374375376...444 Next