Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5057 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-46678 1 Dell 1 Wyse Management Suite 2025-03-24 4.9 Medium
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.
CVE-2022-46677 1 Dell 1 Wyse Management Suite 2025-03-24 6.8 Medium
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for which the admin is not authorized.
CVE-2022-46755 1 Dell 1 Wyse Management Suite 2025-03-24 4.9 Medium
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.
CVE-2024-1343 1 Laborofficefree 1 Laborofficefree 2025-03-24 4.7 Medium
A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.
CVE-2022-46754 1 Dell 1 Wyse Management Suite 2025-03-21 8.7 High
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities.
CVE-2023-31346 2 Amd, Redhat 128 Epyc 7203 Firmware, Epyc 7203p, Epyc 7203p Firmware and 125 more 2025-03-21 6 Medium
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
CVE-2023-23835 1 Mendix 1 Mendix 2025-03-20 5.9 Medium
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions < V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.15). Some of the Mendix runtime API’s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors.
CVE-2024-5691 2 Mozilla, Redhat 8 Firefox, Firefox Esr, Thunderbird and 5 more 2025-03-20 4.7 Medium
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVE-2024-41243 1 Lopalopa 1 Responsive School Management System 2025-03-20 5.3 Medium
An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view MARKS details.
CVE-2023-42957 1 Apple 4 Ipados, Iphone Os, Macos and 1 more 2025-03-20 3.3 Low
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10. An app may be able to read sensitive location information.
CVE-2023-20927 1 Google 1 Android 2025-03-19 7.8 High
In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244216503
CVE-2022-46892 1 Amperecomputing 4 Ampere Altra, Ampere Altra Firmware, Ampere Altra Max and 1 more 2025-03-19 9.8 Critical
In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex.
CVE-2022-38935 1 Niter 1 Niterforum 2025-03-19 8.8 High
An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminController.java, allows attackers to gain escalated privileges.
CVE-2024-7001 1 Google 1 Chrome 2025-03-19 4.3 Medium
Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-57032 1 Wegia 1 Wegia 2025-03-19 9.8 Critical
WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senha_antiga field.
CVE-2023-24485 1 Citrix 1 Workspace 2025-03-19 7.8 High
Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
CVE-2024-41600 1 Talelin 1 Lin-cms-spring-boot 2025-03-19 7.5 High
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
CVE-2024-22074 1 Dynamsoft 1 Dynamsoft Service 2025-03-19 9.8 Critical
Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1.0.516 through 1.3.0115 has Incorrect Access Control. This is fixed in 1.8.2014, 1.7.4212, 1.6.3212, 1.5.31212, 1.4.3212, and 1.3.3212.
CVE-2023-24484 1 Citrix 1 Workspace 2025-03-18 5.5 Medium
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
CVE-2024-26310 1 Archerirm 1 Archer 2025-03-18 4.3 Medium
Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploit this to gain access to API information that should only be accessible with extra privileges.