CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dell emc isilon onefs, isilon onefs +1 moreIn Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In...6.7 Medium
- heimdalsecurity heimdalA vulnerability has been found in Heimdal PRO v2.2.190, but it is most likely also present in...7.8 High
- amd epyc server firmwareThe AMD EPYC Server processor chips have insufficient access control for protected memory regions...9.0 Critical
- amd ryzen firmware, ryzen pro firmware +1 moreThe AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure...9.0 Critical
- amd ryzen firmware, ryzen mobile firmware, ryzen pro firmware +2 moreThe AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for...9.0 Critical
- tenable nessusWhen installing Nessus to a directory outside of the default location, Nessus versions prior to 7...7.0 High
- dell emc windows stemcellsIn Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on...8.5 High
- mercurial, debian linux +1 moreMercurial Incorrect Access Control vulnerability9.1 Critical
- hcl software workload scheduler, ibm tivoli workload scheduler +1 moreIBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4)...7.4 High
- ajentiAjenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that...6.5 Medium
- iredmailiRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in...7.5 High
- roundcube webmailroundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma...7.5 High
- hola vpnAn issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the...8.8 High
- jabberd2The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the...5.5 Medium
- jabberd2The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router,...7.8 High
- weblogexpert weblog expert\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has...7.8 High
- red hat, inc. openshift enterprise, redhat openshift +1 moreRed Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container...7.1 High
- rapidscada rapid scadaA vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak...7.8 High
- opensuse open build serviceopen-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions4.4 Medium
- drupal, drupal core, drupal.org drupal core +1 more +3 moreDrupal access bypass vulnerability5.3 Medium
- ibm sdk, java technology edition, java sdk +1 moreUnder certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0)...8.1 High
- npmjs npmIncorrect Permission Assignment for Critical Resource in NPM7.8 High
- privatevpn** DISPUTED ** PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability...8.8 High
- abb microscada, hitachienergy sys600 firmware +1 moreThis vulnerability allows local attackers to escalate privileges on vulnerable installations of...7.8 High
- zyxel p-870h-51 dsl router, p-870h-51 firmware +1 moreThis vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable...9.8 Critical
- shadow project shadowAn issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an...5.3 Medium
- huawei oceanstor 2800 firmware, oceanstor 5300 firmware, oceanstor 5500 firmware +3 more +5 moreHuawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10,...3.1 Low
- google androidIn the KeyStore service, there is a permissions bypass that allows access to protected resources....7.8 High
- firebase admin sdk for php project admin sdk for phpJerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability8.1 High
- postgresql, canonical ubuntu linux, debian linux +1 more +3 moreIn postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7...7.0 High
- malwarefox antimalwareAn issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32...7.8 High
- malwarefox antimalwareAn issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32...7.8 High
- icingaAn issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after...5.5 Medium
- haystacksoftware arqThe standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to...7.8 High
- haystacksoftware arqThe arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary...7.8 High
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreInsufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote...6.5 Medium
- jenkins speaks\!Arbitrary code execution vulnerability in Jenkins Speaks! Plugin8.8 High
- cisco policy suiteA vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS)...7.5 High
- cisco industrial ethernet 4010 series firmwareA vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010...6.7 Medium
- fiberhome lm53q1 firmwareImproper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended...9.8 Critical
- ibm security access manager, security access manager 9.0 firmware, security access manager for mobile +1 more +3 moreIBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security...4.2 Medium
- intenogroup iopsysInteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS...8.8 High
- ibm mq, websphere mq +1 moreIBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it...3.3 Low
- microsoft windows 10, windows 8.1, windows server 2012 +2 more +4 moreThe Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold,...7.8 High
- nylas mail lives project mailNylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to...7.8 High
- brave browserBrave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect...4.7 Medium
- cambium networks cnpilot, cambiumnetworks cnpilot e400 firmware, cnpilot e410 firmware +3 more +5 moreIn versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to...8.8 High
- ibm security guardiumIBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that...5.4 Medium
- sistemagpweb gpwebInsecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view...9.8 Critical
- ibm tivoli workload schedulerIBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a...3.3 Low
- Show moreLoading…