CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- buffalo ts5600d1206 firmwareIncorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to...8.8 High
- roche accu-chek inform ii firmware, base unit hub firmware, coaguchek firmware +1 more +3 moreAn issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04...8.0 High
- polycom trio 8500 firmwareThe Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access...6.5 Medium
- intel media server studioImproper directory permissions in the installer for the Intel Media Server Studio may allow...7.8 High
- sap fiori clientThe broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori...7.8 High
- sap fiori clientLocally, without any permission, an arbitrary android application could delete the SSO...7.8 High
- foscam c2 application firmware, c2 system firmware, opticam i5 application firmware +1 more +3 moreAn issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application...5.5 Medium
- foscam c2 application firmware, c2 system firmware, opticam i5 application firmware +1 more +3 moreAn issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application...7.8 High
- [unknown] redis, redhat openstack +1 moreA permissions flaw was found in redis, which sets weak permissions on certain files and...4.0 Medium
- asrock a-tuning, f-stream, rgbled +1 more +3 moreThe AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning...7.8 High
- asrock a-tuning, f-stream, rgbled +1 more +3 moreThe AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning...7.1 High
- asrock a-tuning, f-stream, rgbled +1 more +3 moreThe AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning...7.8 High
- qualcomm, inc. snapdragon mobile, qualcomm sd 845 firmware, sd 850 firmware +2 moreImproper access control in core module lead XBL_LOADER performs the ZI region clear for QTEE...5.5 Medium
- debian crossroadsCrossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local...7.8 High
- apache impalaIn Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may...9.8 Critical
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreA vulnerability where a WebExtension can run content scripts in disallowed contexts following...6.5 Medium
- wifiranger firmwareAn incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with...8.8 High
- splunkSplunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non...7.0 High
- emc secure remote services, dell emc esrs virtual edition +1 moreDell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission...7.3 High
- huawei anne-al00, anne-al00 firmware +1 moreAnne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak...2.4 Low
- atlassian crucible, fisheye, fisheye and crucible +2 moreThe Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows...7.8 High
- nuuo cmsNUUO CMS all versions 3.1 and prior, The application implements a method of user account control...8.8 High
- ibm spectrum lsfIBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to change their job user...5.9 Medium
- intel compute module hns2600bp firmware, compute module hns2600bpr firmware, server board s2600bp firmware +12 more +14 moreInsufficient access protection in firmware in Intel Server Board, Intel Server System and Intel...7.6 High
- intel client nvme, datacenter nvme, rapid storage technology +1 more +3 morePermissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe...7.8 High
- microsoft windows 10, windows 10 servers, windows 7 +8 more +10 moreAn elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS...7.8 High
- seqrite end point securitySeqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite...7.8 High
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in...4.2 Medium
- paramiko, canonical ubuntu linux, debian linux +8 more +10 moreParamiko Authentication Bypass vulnerability8.8 High
- dell emc unity, unityvsa, dell emc unity operating environment +1 more +3 moreDell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x...7.8 High
- cisco prime infrastructureCisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability9.8 Critical
- cisco webex business suite 31, webex business suite 32, webex business suite 33 +2 more +4 moreA vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow...7.3 High
- verint collaboration compliance, quality management platform +1 moreVerba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure...8.8 High
- nvidia geforce experienceNVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which...7.0 High
- ibm websphere portalIBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box...5.3 Medium
- pcprotect antivirusPCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect,...7.8 High
- [unknown] sos-collector, redhat enterprise linux desktop, enterprise linux server +3 more +5 moreIt was discovered that sos-collector does not properly set the default permissions of newly...5.9 Medium
- suse shadowPrivilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE...7.8 High
- ee ee40vb firmwareThe installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband...7.8 High
- philips e-alert unit (non-medical device), e-alert firmware +1 morePhilips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon...7.5 High
- honeywell ck75, cn51, cn75 +12 more +14 moreOn Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40...5.8 Medium
- softcase t-router firmwareAn issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on...9.8 Critical
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could...8.4 High
- qualcomm msm8909w firmware, msm8996au firmware, sd205 firmware +18 more +20 moreIn Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD...7.8 High
- oracle webcenter interactionAn issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID...5.4 Medium
- ucms project ucmsuser/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user...8.8 High
- intel computing improvement program, intel corporation intel(r) computing improvement program +1 morePrivilege escalation in file permissions in Intel Computing Improvement Program before version 2...7.8 High
- intel openvino toolkit, intel corporation intel(r) openvino(tm) toolkit for windows +1 moreDirectory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may...7.8 High
- intel driver \& support assistant, intel corporation intel(r) driver & support assistant +1 morePrivilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may...7.8 High
- lwolf loading docsInsecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to...7.5 High
- Show moreLoading…