Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5051 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-47962 1 Microsoft 2 .windows Sdk, Windows Software Development Kit 2026-02-26 7.8 High
Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally.
CVE-2025-33073 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2026-02-26 8.8 High
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
CVE-2025-23048 2 Apache, Apache Software Foundation 2 Http Server, Apache Http Server 2026-02-26 9.1 Critical
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
CVE-2025-46889 1 Adobe 2 Adobe Experience Manager, Experience Manager 2026-02-26 5.4 Medium
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized elevated access. Exploitation of this issue does not require user interaction.
CVE-2025-27689 1 Dell 1 Idrac Tools 2026-02-26 7.8 High
Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2025-50060 1 Oracle 1 Bi Publisher 2026-02-26 8.1 High
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle BI Publisher accessible data as well as unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2025-50070 1 Oracle 2 Database Server, Jdbc 2026-02-26 5.3 Medium
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 23.4-23.8. Difficult to exploit vulnerability allows low privileged attacker having Authenticated OS User privilege with logon to the infrastructure where JDBC executes to compromise JDBC. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JDBC, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JDBC accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N).
CVE-2025-50105 1 Oracle 1 Universal Work Queue 2026-02-26 8.1 High
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2025-50108 1 Oracle 1 Hyperion Financial Reporting 2026-02-26 5.4 Medium
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). The supported version that is affected is 11.2.20.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVE-2025-53028 1 Oracle 1 Vm Virtualbox 2026-02-26 8.2 High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2025-53729 1 Microsoft 1 Azure File Sync 2026-02-26 7.8 High
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
CVE-2025-24999 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-26 8.8 High
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-55244 1 Microsoft 3 Azure, Azure Ai Bot Service, Azure Bot Service 2026-02-26 9 Critical
Azure Bot Service Elevation of Privilege Vulnerability
CVE-2025-54914 1 Microsoft 2 Azure, Azure Networking 2026-02-26 10 Critical
Azure Networking Elevation of Privilege Vulnerability
CVE-2025-49707 1 Microsoft 33 Dcadsv5 Series Azure Vm, Dcasv5 Series Azure Vm, Dcedsv5 Series Azure Vm and 30 more 2026-02-26 7.9 High
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
CVE-2025-49692 1 Microsoft 2 Azure, Azure Connected Machine Agent 2026-02-26 7.8 High
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
CVE-2025-54098 1 Microsoft 27 Windows, Windows 10, Windows 10 1507 and 24 more 2026-02-26 7.8 High
Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2025-10201 2 Google, Linux 5 Android, Chrome, Chrome Os and 2 more 2026-02-26 8.8 High
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2025-7051 1 N-able 1 N-central 2026-02-26 8.3 High
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
CVE-2025-53763 1 Microsoft 2 Azure, Office Purview Data Governance 2026-02-26 9.8 Critical
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.