CWE-284— Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.— MITRE CWE catalog

6,274 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-284page 20 of 126

CVE-2019-11892HIGHCVSS 8.0EG 8.0
2019-05-29
A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring ba…
CVE-2019-11894MEDIUMCVSS 5.7EG 5.7
2019-05-29
A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adver…
CVE-2019-11895MEDIUMCVSS 5.3EG 5.3
2019-05-29
A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In…
CVE-2019-11896HIGHCVSS 7.1EG 7.1
2019-05-29
A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to e…
CVE-2019-11899HIGHCVSS 7.5EG 7.5
2019-09-12
An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client installations need to be authorized by the …
CVE-2019-12627HIGHCVSS 7.5EG 7.5
2019-08-21
A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to in…
CVE-2019-12648HIGHCVSS 8.8EG 8.8
2019-09-25
A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability i…
CVE-2019-12670MEDIUMCVSS 6.7EG 6.7
2019-09-25
A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is due to insufficien…
CVE-2019-13028HIGHCVSS 8.8EG 8.8
2019-06-28
An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML …
CVE-2019-13656CRITICALCVSS 9.8EG 9.8
2019-09-06
An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code.
CVE-2019-13919MEDIUMCVSS 4.3EG 4.3
2019-09-13
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user can also be accessed by a non-privileged user. The security vulnerability could b…
CVE-2019-14838MEDIUMCVSS 4.9EG 4.9
2019-10-14
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
CVE-2019-14902MEDIUMCVSS 5.4EG 5.4
2020-01-21
There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be take…
CVE-2019-15068CRITICALCVSS 9.8EG 9.8
2019-09-25
A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication.
CVE-2019-15255MEDIUMCVSS 6.5EG 6.5
2020-01-26
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability e…
CVE-2019-15260CRITICALCVSS 9.8EG 9.8
2019-10-16
A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access contro…
CVE-2019-15589HIGHCVSS 8.8EG 8.8
2019-12-18
An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
CVE-2019-15590HIGHCVSS 7.5EG 7.5
2020-01-28
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elastics…
CVE-2019-15591MEDIUMCVSS 6.5EG 6.5
2019-12-18
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
CVE-2019-15615MEDIUMCVSS 6.1EG 6.1
2020-02-04
A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
CVE-2019-15956HIGHCVSS 8.8EG 8.8
2019-11-26
A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability…
CVE-2019-15967MEDIUMCVSS 4.4EG 4.4
2019-11-26
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence…
CVE-2019-15998MEDIUMCVSS 5.3EG 5.3
2019-11-26
A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected…
CVE-2019-15999MEDIUMCVSS 6.3EG 6.3
2020-01-06
A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform (JBoss EAP) on an affected de…
CVE-2019-1601HIGHCVSS 7.8EG 7.8
2019-03-08
A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical configuration file. The vulnerability is due to a failure to impose strict files…
CVE-2019-1619CRITICALCVSS 9.8EG 9.8
2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an a…
CVE-2019-1622HIGHCVSS 5.3EG 8.6
2019-06-27
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improp…
CVE-2019-1647HIGHCVSS 8.0EG 8.0
2019-01-24
A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to other vSmart containers. The vulnerability is due to an insecure default configura…
CVE-2019-1649MEDIUMCVSS 6.7EG 6.7
2019-05-13
A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. …
CVE-2019-1653CRITICALCVSS 7.5EG 9.0⚠ KEV
2019-01-24
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to impro…
CVE-2019-1660MEDIUMCVSS 5.3EG 5.3
2019-02-07
A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due t…
CVE-2019-1664HIGHCVSS 7.8EG 7.8
2019-02-21
A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker…
CVE-2019-16640HIGHCVSS 7.5EG 7.5
2024-07-16
An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not checked), which can allow an attacker to upload any file to the gateway. This affe…
CVE-2019-1666MEDIUMCVSS 5.3EG 5.3
2019-02-21
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker c…
CVE-2019-1686HIGHCVSS 8.6EG 8.6
2019-04-17
A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on a…
CVE-2019-1690MEDIUMCVSS 6.5EG 6.5
2019-03-11
A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due…
CVE-2019-1695MEDIUMCVSS 6.5EG 6.5
2019-05-03
A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to send data directly to the kernel of an affec…
CVE-2019-1759MEDIUMCVSS 5.3EG 5.3
2019-03-28
A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet M…
CVE-2019-1763HIGHCVSS 7.5EG 7.5
2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause…
CVE-2019-1805MEDIUMCVSS 4.3EG 4.3
2019-04-18
A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to access a CLI instance on an affecte…
CVE-2019-18275MEDIUMCVSS 6.5EG 6.5
2020-01-15
OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access control, which may return unauthorized tag data when viewing analysis data reference attributes.
CVE-2019-18308HIGHCVSS 7.8EG 7.8
2019-12-12
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with local access to the MS3000 Server and a low privileged user account could gain root privileges by manipulating specific files in the…
CVE-2019-18309HIGHCVSS 7.8EG 7.8
2019-12-12
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with local access to the MS3000 Server and a low privileged user account could gain root privileges by manipulating specific files in the…
CVE-2019-1866LOWCVSS 3.1EG 3.1
2020-04-13
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An at…
CVE-2019-1890MEDIUMCVSS 6.5EG 6.5
2019-07-04
A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, adjacent attacker to bypass security va…
CVE-2019-18998HIGHCVSS 7.1EG 7.1
2020-02-17
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's UR…
CVE-2019-20462MEDIUMCVSS 5.3EG 5.3
2024-11-07
An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device comes with a serial interface at the board level. By attaching to this serial interface and rebooting the device, a large amount of information is disclosed. This inc…
CVE-2019-20470HIGHCVSS 7.5EG 7.5
2021-02-01
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up a voice communication channel from the watch to any telephone number, initiated …
CVE-2019-20473MEDIUMCVSS 6.8EG 6.8
2021-02-01
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and ca…
CVE-2019-25060MEDIUMCVSS 5.3EG 5.3
2022-05-09
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of ever…

Map vulnerabilities like CWE-284 to your infrastructure

EchelonGraph correlates every CVE — across CWE-284 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →