CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- pyinstallerLocal Privilege Escalation present only on the Windows version of PyInstaller7.0 High
- schedmd slurm, opensuse leap +1 moreSchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.5.5 Medium
- webfactoryltd minimal coming soon \& maintenance modeA flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows...7.6 High
- gitlabGitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.4.3 Medium
- gitlabGitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.4.3 Medium
- gitlabGitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).4.3 Medium
- gitlabGitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).4.3 Medium
- mfscripts yetishareMFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies,...6.1 Medium
- webfactoryltd 301 redirectsThe "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with...9.0 Critical
- red hat tower, redhat ansible tower +1 moreA flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower...5.9 Medium
- adobe coldfusionColdFusion versions Update 6 and earlier have an insecure inherited permissions of default...9.8 Critical
- shadow project shadowshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux,...7.8 High
- debian edu, debian-lan-config, skolelinux debian-edu-config +2 more +4 moreDebian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu,...7.8 High
- nalpeiron licensing serviceNLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products,...7.1 High
- google androidIn various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and...5.5 Medium
- aviatrix vpn clientWeak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on...7.8 High
- openstack nova, debian linux, openstack-nova +2 moreOpenStack nova base images permissions are world readable5.5 Medium
- openbsdOpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled,...7.8 High
- maxpcsecure anti virus plusMax Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory....7.8 High
- huawei p20, p20 firmware +1 moreThere is an improper access control vulnerability in Huawei Share. The software does not properly...5.5 Medium
- packagekit, debian linux, redhat enterprise linux server +2 morePackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which...5.3 Medium
- accountsservice project accountsservice, debian linux, opensuse +1 more +3 moreAn issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in...3.3 Low
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving...5.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the...5.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected...5.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has...4.3 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure...4.3 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization...3.7 Low
- kyrolsecuritylabs kyrol internet securityIOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to...7.8 High
- centreon webCentreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF ...7.8 High
- gonitro nitro proNitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if...7.8 High
- intel proset\/wireless wifiImproper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may...7.1 High
- intel proset\/wireless wifiImproper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may...7.1 High
- mi redmi 6 firmwareThe Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india...3.3 Low
- lavamobiles z60s firmwareThe Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229...3.3 Low
- lavamobiles iris 88 firmwareThe Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1...3.3 Low
- lavamobiles z81 firmwareThe Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user...3.3 Low
- lavamobiles z61 firmwareThe Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0...3.3 Low
- lavamobiles z92 firmwareThe Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user...3.3 Low
- lavamobiles iris 88 firmwareThe Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0...3.3 Low
- lavamobiles flair z1 firmwareThe Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131...3.3 Low
- moodle, fedoraproject fedora +1 moreMoodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can...2.7 Low
- scanguard antivirusScanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory,...7.8 High
- artifex ghostscript, fedoraproject fedora, opensuse leap +2 moreA flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure,...7.3 High
- microsoft officeA security feature bypass vulnerability exists in Microsoft Office software by not enforcing...7.8 High
- Show moreLoading…