CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ehang-io npscnlh nps vulnerable to file overwrite by local user5.5 Medium
- maxx waves maxx audioRealtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file...7.8 High
- arista cloudvision portalArista CloudVision Portal through 2018.1.1 has Incorrect Permissions.6.5 Medium
- sap enable nowThe session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If...8.8 High
- estsoft altools, altools update service +1 moreALTOOLS update service 18.1 and earlier versions contains a local privilege escalation...7.8 High
- netwrix auditorNetwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs...7.8 High
- 3cx3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows...7.8 High
- cisco adaptive security appliance software, adaptive security appliance (asa) software +1 moreCisco Adaptive Security Appliance Smart Tunnel Vulnerabilities6.7 Medium
- valvesoftware steam client** DISPUTED ** In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node...6.6 Medium
- pivotal software cloud foundry uaa, cloud foundry uaa release (oss), pivotal software application service +1 more +3 moreUAA clients.write vulnerability7.3 High
- cpanelcPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).3.3 Low
- cpanelcPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups ...7.1 High
- cpanelcPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template...5.5 Medium
- cpanelcPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).4.3 Medium
- cpanelcPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature...4.3 Medium
- cpanelcPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature...5.4 Medium
- cpanelcPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature...4.3 Medium
- univa grid engineIn Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on...9.8 Critical
- cpanelcPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).3.3 Low
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that...4.2 Medium
- akeo rufusAkeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is:...9.8 Critical
- huawei honor magic 2, honor magic 2 firmware +1 moreThere is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in...5.5 Medium
- zohocorp manageengine admanager plus, manageengine adselfservice plus, manageengine desktop central +2 moreZoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have...7.3 High
- dglogik dglux serverDGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote...9.8 Critical
- londontrustmedia private internet access vpn clientA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS...7.8 High
- razer surroundThe RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0...5.5 Medium
- maxx waves maxx audioWavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has...7.3 High
- odooImproper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0...6.5 Medium
- odooIncorrect access control in the mail templating system in Odoo Community 11.0 and earlier and...6.5 Medium
- odooIncorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and...4.3 Medium
- odooThe module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and...4.9 Medium
- loytec lgate-902 firmwareLOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.9.1 Critical
- gnome glibThe keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates directories using...7.5 High
- google androidIn ServiceManager::add function in the hardware service manager, there is an insecure permissions...7.8 High
- zohocorp manageengine analytics plus, manageengine browser security plus, manageengine desktop central +15 more +17 moreMultiple Zoho ManageEngine products suffer from local privilege escalation due to improper...7.8 High
- foxitsoftware foxit pdf sdk activexA File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional...7.8 High
- qualcomm, inc. snapdragon auto, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm mdm9150 firmware, mdm9607 firmware +22 more +24 moreWrong permissions in configuration file can lead to unauthorized permission in Snapdragon Auto,...7.8 High
- intel ite tech consumer infrared driverImproper permissions in the installer for the ITE Tech* Consumer Infrared Driver for Windows 10...7.8 High
- broadcom bcm4335c0 firmware, bcm43438a1 firmware, cypress cyw20702a1kwfbg firmware +60 more +62 moreBroadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1...8.8 High
- enttec datagate mk2 firmware, e-streamer mk2 firmware, pixelator firmware +1 more +3 moreAn issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with...7.8 High
- gemalto sentinel ldkHasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have ...6.5 Medium
- kromtech mackeeperKromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com...9.8 Critical
- ivanti landesk management suiteImproper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka...9.0 Critical
- firejail project firejailIn Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of...8.8 High
- iball ib-wrb302n firmwareiBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface,...6.8 Medium
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non...7.4 High
- pandasecurity panda antivirus, panda antivirus pro, panda dome +3 more +5 moreInsecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event...9.8 Critical
- kentico xperienceKentico 11 through 12 lets attackers upload and explore files without authentication via the...9.1 Critical
- opentext brava\!OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by...7.4 High
- libvirt, fedoraproject fedora +1 moreA vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin...8.8 High
- Show moreLoading…