CWE-284
8,896 CVEs • Abstraction: Pillar
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVEs (8,896)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401). |
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). |
cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
2Redhat Theforeman2Foreman SatelliteNov 21, 2024 Aug 1, 2019 N/A· v4 7.4 HIGH· v3 6.5 MEDIUM· v2 It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access reso...Show more |
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment. |
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to. |
2Canonical Redhat5Enterprise Linux LibvirtUbuntu Linux+2 moreJun 17, 2026 Jul 30, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of...Show more |
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved. |
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to gen...Show more |
2Opensuse Postgresql2Leap PostgresqlJun 17, 2026 Jul 30, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Cert...Show more |