CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- coreboscoreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module:...5.3 Medium
- wpulike ulikeWP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can...7.5 High
- silkypress image zoomWP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings...6.5 Medium
- froxlorFroxlor Incorrect Access Control7.5 High
- phusion passengerPhusion Passenger incorrect permission assignment5.3 Medium
- openwrt** DISPUTED ** OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl...8.8 High
- phusion passengerIncorrect Access Control in Phusion Passenger7.8 High
- phusion passengerInsecure Permissions in Phusion Passenger8.8 High
- ecos system management applianceIncorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to...7.3 High
- expresscart project expresscartexpress-cart allows any user to create an admin user8.8 High
- microsoft windows 10, windows 10 servers, windows 7 +7 more +9 moreAn elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS...7.0 High
- microsoft windows 10, windows 10 servers, windows server 2016 +2 moreAn elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces...7.0 High
- apollotechnologiesinc momentum axel 720p firmwareAn issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART...6.8 Medium
- apple mac os xAn issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue...5.5 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue...2.4 Low
- apple swiftAn issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is...8.8 High
- crowbar project crowbarinsecure permissions on files containing confidential data3.3 Low
- cisco wide area application servicesA vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services ...6.7 Medium
- burp project burpThe Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp...7.1 High
- burp project burpThe Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to...7.1 High
- quest disk backupQuest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6...8.8 High
- quest disk backupQuest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5...8.8 High
- quest disk backupQuest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4...8.8 High
- quest disk backupQuest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3...8.8 High
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security...4.2 Medium
- windscribeWindscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain...7.8 High
- [unknown] jenkinsIncorrect Permission Assignment for Critical Resource in Jenkins5.4 Medium
- postgresql, opensuse leap +1 morepostgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog...4.2 Medium
- vmware xenonVMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0...7.5 High
- f5 big-iq centralized management, big-iq cloud and orchestration, iworkflow +16 more +18 moreOn F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ...4.7 Medium
- safervpnSaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its ...7.8 High
- cyberghostvpn cyberghostCyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability...7.8 High
- goldenfrog vyprvpnGolden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation...7.8 High
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreLack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote...8.8 High
- cmsmadesimple cms made simpleIn CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard...6.5 Medium
- cmsmadesimple cms made simpleCMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to...8.8 High
- cmsmadesimple cms made simpleIn CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard...6.5 Medium
- mcafee tunnelbearTunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through...9.8 Critical
- ericssonlg ipecs nmsThe Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since...9.8 Critical
- purevpnPureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its ...8.8 High
- lightsamlLightSAML Incorrect Access Control vulnerability7.5 High
- cmsmadesimple cms made simplecmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of...8.8 High
- zohocorp manageengine desktop centralAn issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network...7.2 High
- nordvpnNordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the...9.8 Critical
- protonmail protonvpnProtonVPN 1.3.3 for Windows suffers from a SYSTEM privilege escalation vulnerability through the ...9.8 Critical
- apache hiveIncorrect Permission Assignment for Critical Resource in Apache hive3.7 Low
- koji project kojiKoji hub call does not perform correct access checks9.1 Critical
- ibm qradar security information and event manager, security qradar siem +1 moreIBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that...4.2 Medium
- cloudfoundry silk-releaseCloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control...8.1 High
- pivotal software bosh cliCloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control...8.8 High
- Show moreLoading…