CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cognito moneyworksPassword exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain...9.8 Critical
- flatpak, debian linux +1 moreIn Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain...7.8 High
- elastic x-pack, x-pack security +1 moreX-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi...7.5 High
- elastic x-pack security, x-pack +1 moreX-Pack Security 5.2.x would allow access to more fields than the user should have seen if the...5.9 Medium
- kbvault mysql project mysqlKBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer...9.8 Critical
- infotecs vipnet client, vipnet coordinator +1 moreInfotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by...7.3 High
- trustedfirmware trusted firmware-aIn ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing...8.1 High
- mercurial, debian linux, redhat enterprise linux desktop +5 more +7 moreMercurial has Incorrect Permission Assignment for Critical Resource8.8 High
- fortinet fortiportal, fortinet, inc. fortinet fortiportal +1 moreAn improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows...9.1 Critical
- mimosa client radios, backhaul radios +1 moreAn issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface,...7.5 High
- dropbear ssh project ssh, debian linux +1 moreDropbear before 2017.75 might allow local users to read certain files as root, if the file has...4.7 Medium
- qemu, debian linux +1 moreQuick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs)...7.8 High
- google androidAn Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious...5.5 Medium
- google androidAn elevation of privilege vulnerability in the Framework APIs could enable a local malicious...7.8 High
- veritas netbackup, netbackup appliance +1 moreIn Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is...9.8 Critical
- veritas netbackup, netbackup appliance +1 moreIn Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is...9.8 Critical
- veritas netbackup, netbackup appliance +1 moreIn Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is...9.8 Critical
- nvidia gpu display driver, gpu driver +1 moreAll versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where...7.8 High
- ca client automationThe OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1...5.5 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreCybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- mozilla firefox, firefox esr, redhat enterprise linux +5 more +7 moreA mechanism to bypass file system access protections in the sandbox using the file system request...9.8 Critical
- tenable nessusNessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due...7.8 High
- tenable nessusNessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due...5.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 moreThe mm subsystem in the Linux kernel through 3.2 does not properly enforce the...7.8 High
- adobe creative cloudAdobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper...8.8 High
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders...4.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via...6.4 Medium
- trendmicro interscan web security virtual applianceMultiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6...6.5 Medium
- riverbed riosRiverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which...6.8 Medium
- solarwinds log and event managerThe editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated...8.8 High
- sap gui for windowsSAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions...9.8 Critical
- tenable nessusNessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local...7.8 High
- paloaltonetworks terminal services agentPalo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak...5.3 Medium
- mozilla firefox, thunderbird +1 moreOn Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media...5.3 Medium
- puppet mcollective-puppet-agent, mcollective-puppet-agent plugin +1 moreOn Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non...8.8 High
- zen mobile app native project mobile app native, zendkmobileapp wordpress plugin mobile app native 3.0 +1 moreRemote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.7.5 High
- nvidia gpu driver, nvidia corporation windows gpu display driver +1 moreAll versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it...7.5 High
- nvidia gpu display driver, gpu driver +1 moreNVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where...8.8 High
- google androidAn elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage...5.3 Medium
- linux kernel, embysupport security +1 moreIt was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an...4.4 Medium
- dovecot, fedora dovecot22, opensuse leap +2 more +4 moreA postinstall script in the dovecot rpm allows local users to read the contents of newly created...3.3 Low
- dracut project dracutA local information disclosure issue was found in dracut before 045 when generating initramfs...5.0 Medium
- google chrome, chromium-browser +1 morebrowser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS,...9.1 Critical
- google chromeThe developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before...7.5 High
- google chrome, opensuse +1 moreGoogle Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does...7.5 High
- ipmitool project ipmitoolipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red...3.6 Low
- mcafee email gateway, secure mail +1 moreThe web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated...6.5 Medium
- microsoft internet explorer, windows 2000, windows 2003 server +4 more +6 moreMicrosoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified ...4.3 Medium
- drbd8drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets,...7.8 High
- dovecotDovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at...5.5 Medium
- Show moreLoading…