CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- drupal svg sanitizerA Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for...7.5 High
- medtronic valleylab ft10 energy platform (vlft10gen), valleylab ls10 energy platform (vlls10gen—not available in the united states), valleylab ft10 energy platform firmware +1 more +3 moreMedtronic Valleylab FT10 and LS10 Protection Mechanism Failure4.6 Medium
- zte corporation zxupn-9000e, zte zxupn-9000e firmware +1 moreThe 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by...8.8 High
- [unknown] openstack-mistralAn information-exposure vulnerability was discovered where openstack-mistral's undercloud log...5.9 Medium
- [unknown] 389-ds-base, debian linux, fedoraproject 389 directory server +1 more +3 moreA flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission...6.5 Medium
- viewvc, debian linux +1 moreviewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden"...7.5 High
- rapid7 metasploit, metasploit pro +1 moreMAGICK3.3 Low
- mesa3d mesa, canonical ubuntu linux, debian linux +1 more +3 moreAn exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D...5.1 Medium
- apache impalaIn Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala...7.5 High
- ovirt ovirt-engineovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due...7.8 High
- apache struts, redhat jboss enterprise web server +1 moreStruts ParameterInterceptor vulnerability allows remote command execution9.8 Critical
- xen, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of...8.8 High
- red hat jboss, redhat jboss operations network +1 moreA missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not...8.0 High
- zenspider ruby parser-legacyRuby_parser-legacy Incorrect Permission Assignment for Critical Resource7.8 High
- gnu guixGNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the...7.8 High
- adobe download managerAdobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability....9.8 Critical
- intel smart connect technology, intel® smart connect technology for intel® nuc advisory +1 moreImproper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R)...7.8 High
- softing uagate si firmwareAn issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is...7.5 High
- softing uagate si firmwareAn issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable...9.8 Critical
- microsoft windows 10 update assistant, windows update assistant +1 moreAn elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it...7.8 High
- juniper junos, juniper networks junos os +1 moreJunos OS: PKI key pairs are exported with insecure file permissions6.6 Medium
- dell avamar, emc avamar server, emc integrated data protection appliance +1 more +3 moreDell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data...8.1 High
- orbisius child theme creatorThe orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control...6.5 Medium
- evernoteEvernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute...7.8 High
- google androidIn the Activity Manager service, there is a possible permission bypass due to incorrect...7.8 High
- silverstripeLack of access control on upoaded files5.3 Medium
- totaldefense anti-virusIn Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%...7.8 High
- totaldefense anti-virusIn Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%...7.8 High
- google chromeInsufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote...4.3 Medium
- google chromeInsufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote...3.3 Low
- google chromeInsufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed...6.5 Medium
- google chromeInsufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a...4.3 Medium
- google chromeInsufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker...6.5 Medium
- codesys control for beaglebone, control for empc-a\/imx6, control for iot2000 +7 more +9 moreAn issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can...8.8 High
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An...5.4 Medium
- intel easy streaming wizardImproper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1...6.7 Medium
- beegoIncorrect Default Permissions in Beego5.5 Medium
- beegoBeego has a file creation race condition4.7 Medium
- limesurveyLimesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows...7.5 High
- changehealthcare cardiology firmware, mckesson horizon cardiology firmware +1 moreA vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions...7.8 High
- cisco content security management appliance (sma), content security management appliance +1 moreCisco Content Security Management Appliance Information Disclosure Vulnerability4.3 Medium
- cisco jabber for mac, jabber +1 moreCisco Jabber Client Framework for Mac Code Execution Vulnerability6.7 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreProcess termination via PID file manipulation5.3 Medium
- docker desktop community edition, docker, apache geode +2 moreDocker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing...7.8 High
- artifex ghostscript, fedoraproject fedora +1 moreA flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure...7.3 High
- valvesoftware steam clientValve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to...7.0 High
- valvesoftware steam clientValve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY...7.8 High
- open-xchange appsuiteOX App Suite 7.10.1 and earlier has Insecure Permissions.3.3 Low
- extenua silvershieldextenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege...7.8 High
- adobe creative cloud desktop application, creative cloud +1 moreCreative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited...9.8 Critical
- Show moreLoading…