The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
100 vulnerabilities with CWE-1220
CVE-2024-2412
MEDIUM
Heimavista Rpage and Epage - User Registration Bypass
CVSS 5.3
CVE-2023-31343
HIGH
AMD EPYC 7003 Processors - Authenticated Arbitrary Code Execution via SMM Handler Input Validation
CVSS 7.5
CVE-2023-31342
HIGH
AMD EPYC 7003 Processors - Arbitrary Code Execution via SMM Handler Input Validation
CVSS 7.5
CVE-2023-45217
HIGH
Intel Power Gadget < 3.6.0 - Authenticated Privilege Escalation via Local Access
CVSS 8.8
CVE-2023-40070
HIGH
Intel Power Gadget for macOS - Authenticated Privilege Escalation via Local Access
CVSS 8.8
CVE-2023-43040
MEDIUM
IBM Spectrum Fusion HCI 2.5.2-2.7.2 - Privilege Escalation
CVSS 6.5
CVE-2023-32259
MEDIUM
OpenText SMAX/AMX <2022.11 - Privilege Escalation
CVSS 6.5
CVE-2023-6725
MEDIUM
OpenStack Designate - Info Disclosure
CVSS 5.5
CVE-2023-50713
MEDIUM
Speckle Server <2.17.6 - Auth Bypass
CVSS 6.5
CVE-2023-44285
HIGH
Dell PowerProtect DD <7.13.0.10-6.2.1.110 - Privilege Escalation
CVSS 7.8
CVE-2023-4456
MEDIUM
openshift-logging LokiStack - Privilege Escalation
CVSS 5.7
CVE-2023-39418
LOW
PostgreSQL 15.0-15.3 - Insufficient Granularity of Access Control via MERGE Command
CVSS 3.1
CVE-2023-33127
HIGH
.NET 6.0.0-6.0.19 and Visual Studio 2022 < 17.0.23 - Elevation of Privilege
CVSS 8.1
CVE-2023-3227
MEDIUM
fossbilling/fossbilling <0.5.0 - Info Disclosure
CVSS 5.7
CVE-2023-0205
MEDIUM
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX < 35.1012 - Denial of Service via Insufficient Access Control
CVSS 5.0
CVE-2023-0203
MEDIUM
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX < 35.1012 - Denial of Service via Insufficient Access Control
CVSS 5.0
CVE-2023-27591
HIGH
miniflux < 2.0.43 - Unauthenticated Information Disclosure via Prometheus Metrics Endpoint
CVSS 7.5
CVE-2022-4813
MEDIUM
usememos/memos <0.9.1 - Info Disclosure
CVSS 4.3
CVE-2022-4801
MEDIUM
GitHub usememos/memos <0.9.1 - Info Disclosure
CVSS 5.3
CVE-2022-2475
CRITICAL
Haas Controller <100.20.000.1110 - Privilege Escalation
CVSS 9.8
CVE-2022-36110
HIGH
Netmaker <0.15.1 - Privilege Escalation
CVSS 8.8
CVE-2022-1461
MEDIUM
OpenEMR < 6.1.0.1 - Insufficient Access Control for User Registration Settings
CVSS 6.5
CVE-2022-1177
MEDIUM
OpenEMR < 6.1.0 - Insufficient Access Control for Patient Reports
CVSS 4.3
CVE-2021-46747
HIGH
AMD Secure Processor - Insufficient Granularity of Access Control in SMN Aperture Mapping
CVE-2021-31384
HIGH
Juniper Junos OS SRX Series 20.4R1-20.4R3, 21.1-21.1R1 - Unauthenticated J-Web Access Bypass
CVSS 7.2
Details
Vulnerabilities
100