CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- scubez posty readymade classifiedsScubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin...7.5 High
- google android, canonical ubuntu linux +1 moreAn elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions:...7.8 High
- arqbackup arqThe (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5)...7.8 High
- icingaetc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user...7.0 High
- huawei fusioncomputeFusionCompute V100R005C00 and V100R005C10 have an improper authorization vulnerability due to...6.5 Medium
- icingaIcinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration...7.8 High
- apereo opencastOpencast has Incorrect Permission Assignment6.5 Medium
- codiadCodiad(full version) is vulnerable to write anything to configure file in the installation...7.5 High
- google androidA denial of service vulnerability in the Android framework (syncstorageengine). Product: Android....7.5 High
- google androidAn elevation of privilege vulnerability in the Android framework (window manager). Product:...7.8 High
- google androidAn elevation of privilege vulnerability in the Android framework (device policy client). Product:...7.8 High
- pnp4nagiosPNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but...7.8 High
- scala-lang scalaHigh severity vulnerability that affects org.scala-lang:scala-compiler7.8 High
- apache hadoopModerate severity vulnerability that affects org.apache.hadoop:hadoop-main7.8 High
- hola vpnHola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to...7.8 High
- boltcms boltBolt Improper Access Control5.3 Medium
- anti-spam smtp proxy project smtp proxyThe Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges...7.8 High
- vde project vdeThe Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to...9.8 Critical
- maharaMahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to...9.8 Critical
- maharaMahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are...8.1 High
- mariadb, mysql +1 moreThe installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev...7.8 High
- openbsd openssh, debian linux, netapp active iq unified manager +18 more +20 moreThe process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write...5.3 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves...5.3 Medium
- octopus deployIn Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to...6.5 Medium
- atlassian bambooBamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a...8.8 High
- jenkins pipeline\Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline8.8 High
- jenkins script securityUnsafe methods in the default list of approved signatures in Jenkins Script Security Plugin6.5 Medium
- apache impalaIn Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an...6.5 Medium
- mozilla firefoxA vulnerability where WebExtensions can download and attempt to open a file of some non...9.8 Critical
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreAn improper access control vulnerability exists in Schneider Electric's U.motion Builder software...7.8 High
- elasticsearch logstashThe init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1...7.8 High
- debian linux, google chrome, redhat enterprise linux desktop +2 more +4 moreBlink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for...4.3 Medium
- gstn india goods and services tax network offline utility toolGSTN_offline_tool in India Goods and Services Tax Network (GSTN) Offline Utility tool before 1.2...7.8 High
- red hat, inc. rhnsdIt was found that rhnsd PID files are created as world-writable that allows local attackers to...5.5 Medium
- google androidA elevation of privilege vulnerability in the Android system (nfc). Product: Android. Versions: 5...8.8 High
- google androidA elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android...7.8 High
- advantech webaccessAn Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech...7.8 High
- kaspersky internet security, kaspersky lab kaspersky internet security for android 11.12.4.1622 +1 moreIn Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities...9.8 Critical
- razer synapseRazer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which...7.8 High
- razer synapseRazer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory,...8.4 High
- microsoft xamarin.iosThe Xamarin.iOS update component on systems running macOS allows an attacker to run arbitrary...7.8 High
- synology download stationSynology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions ...7.8 High
- gitlabGitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an...6.5 Medium
- motorola mx011anm firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices...5.3 Medium
- cisco dpc3939 firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a...9.8 Critical
- cisco dpc3939 firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a...9.8 Critical
- statamicStatamic framework Incorrect Permission Assignment8.8 High
- logicaldocLogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could...8.8 High
- google androidA elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 4.4...7.8 High
- qemuQuick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs)...9.0 Critical
- Show moreLoading…