CWE-284
8,728 CVEs • Abstraction: Pillar
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVEs (8,728)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Cambium Networks 4Epmp 1000 Firmware Epmp 1000 Hotspot FirmwareEpmp 2000 Firmware+1 moreMay 13, 2026 Jun 21, 2017 N/A· v4 6.8 MEDIUM· v3 6.0 MEDIUM· v2 An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. T...Show more |
In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. |
In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. |
In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. |
In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. |
In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. |
In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled. |
In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection. |
Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspecified vectors. |
Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via unspecified vectors. |
Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations via unspecified vectors. |
I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors. |
Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors. |
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors. |
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors. |
1Ibm 2Security Key Lifecycle Manager Tivoli Key Lifecycle ManagerMay 13, 2026 Jun 8, 2017 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. |
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escal...Show more |
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data. |
1Markdown It Project 1Markdown It May 13, 2026 Jun 7, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 markdown-it before 4.1.0 does not block data: URLs. |