CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- zohocorp manageengine desktop centralAn issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10...7.8 High
- zohocorp manageengine desktop centralAn issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company...8.8 High
- dell emc vplex geosynchrony, dell emc vplex software: geosynchrony +1 moreDell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions...4.0 Medium
- absolute ctes windows agentAn issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security...8.8 High
- gleeztech gleez cmsA vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker...5.3 Medium
- google chromeLack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a...4.3 Medium
- tockos tockTOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example...7.5 High
- opsviewThe /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before...8.1 High
- btiteam xbtitAn issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is...9.8 Critical
- kzsoftware asset manager, training manager +1 moreKaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a...7.8 High
- orbic wonder rc555l firmwareAn issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release...7.1 High
- hashicorp packerRecommended update for aws-cli, python-boto3, python-botocore, python-s3transfer5.3 Medium
- accuposAccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files...5.5 Medium
- cobblerd cobblerCobbler Improper Validation of Security Tokens9.8 Critical
- librehealth ehrLibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter...8.8 High
- zemana antiloggerA vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527...7.5 High
- google androidCertain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT...9.8 Critical
- google androidCertain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS...9.8 Critical
- google androidCertain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI...9.8 Critical
- f5 big-ip access policy manager, big-ip access policy manager client, f5 networks, inc. big-ip apm client for linux +1 more +3 moreThe svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for...7.8 High
- siemens simatic step 7 \(tia portal\), simatic wincc \(tia portal\), siemens ag simatic step 7 (tia portal) and wincc (tia portal) v10, v11, v12, simatic step 7 (tia portal) and wincc (tia portal) v13, simatic step 7 (tia portal) and wincc (tia portal) v14, simatic step 7 (tia portal) and wincc (tia portal) v15 +2 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10,...8.6 High
- siemens simatic step 7 \(tia portal\), simatic wincc \(tia portal\), siemens ag simatic step 7 (tia portal) and wincc (tia portal) v10, v11, v12, simatic step 7 (tia portal) and wincc (tia portal) v13, simatic step 7 (tia portal) and wincc (tia portal) v14, simatic step 7 (tia portal) and wincc (tia portal) v15 +2 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10,...7.8 High
- ibm websphere mqIBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have...3.1 Low
- netapp clustered data ontapRead-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release...8.8 High
- opensuse openbuildservice, open build service +1 moredelete package via link exploit in open buildservice6.0 Medium
- opensuse openbuildservice, open build service +1 moreopenbuildservice allowed deleting packages via project links4.4 Medium
- red hat ipa, freeipa, redhat enterprise linux +5 more +7 moreA vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did...8.1 High
- red hat eap-7, redhat jboss enterprise application platform +1 moreIt was found in EAP 7 before 7.0.9 that properties based files of the management and the...5.5 Medium
- [unknown] redhat-certification, redhat certification, enterprise linux +2 moreredhat-certification does not properly restrict files that can be download through the /download...7.5 High
- f5 big-iq centralized management, big-iq cloud and orchestration, enterprise manager +4 more +6 moreOn F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise...4.4 Medium
- cisco mobility services engine 3310 firmware, mobility services engine 3355 firmware, mobility services engine 3365 firmware +2 moreA vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to...5.5 Medium
- doorkeeper project doorkeeperDoorkeeper subject to Incorrect Permission Assignment7.5 High
- sensu coreSensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions...8.8 High
- modx revolutionMODX Revolution Incorrect Access Control vulnerability7.2 High
- monetra mstdlibmstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations...9.8 Critical
- wago 762-3000 firmware, 762-3001 firmware, 762-3002 firmware +1 more +3 moreAn issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before...6.5 Medium
- abbyy flexicaptureThe HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct...9.8 Critical
- mycroft mycroft-coreMycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control...8.1 High
- qualcomm mdm9206 firmware, mdm9607 firmware, mdm9635m firmware +36 more +38 moreDue to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and...7.7 High
- adbglobal dv2210 firmware, prg av4202n firmware, vv2220 firmware +1 more +3 moreAll ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege...7.5 High
- onefilecmsonefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files...6.5 Medium
- ubnt ucrmUbiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the...4.7 Medium
- dialogic powermedia xmsIncorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in...7.8 High
- [unknown] setup, redhat enterprise linux desktop, enterprise linux server +1 more +3 moresetup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and...4.8 Medium
- [unknown] podman, libpod project libpod +1 morePodman Elevated Container Privileges5.3 Medium
- [unknown] source-to-image, redhat openshift container platform +1 moresource-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53...8.5 High
- yxcmsprotected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to...4.9 Medium
- vertiv liebert intellislot firmwareEmerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control...7.5 High
- fortinet fortianalyzer, fortimanager, fortimanager, fortianalyzer +1 more +3 moreAn improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions...6.5 Medium
- dell emc idrac service module, idrac service module +1 moreiSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability6.6 Medium
- Show moreLoading…