CWE-284

Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder w

Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information ov

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Supported ver

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. A

Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown proc

Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE all

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authen

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able

EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The de

A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthent

Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unautho

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access

Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and

Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper acces

Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields w

Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient perm

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.

Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate

Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 all

GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks c

An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the

An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0

Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-le

CWE-284: Improper Access Control

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privi

OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all

Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before

The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, whi

Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a cra

Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 all

DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can

Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauth

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnera

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobili

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobili

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobili

An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creat

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfigura

LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can

Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Appli

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servic

Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Man

An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests