CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- datera, inc targetcli, targetcli-fb project targetcli-fb +1 moreA flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by...7.8 High
- rockwellautomation rslinx classicIn Rockwell Automation RSLinx Classic versions 4.1.00 and prior, an authenticated local attacker...7.8 High
- tencent qqbrowserQQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by...7.8 High
- google androidAn issue was discovered on Samsung mobile devices with N(7.x) software. In Dual Messenger, the...9.1 Critical
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a...5.3 Medium
- ibm rational quality managerIBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create...4.3 Medium
- apachefriends xamppAn issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on...8.8 High
- deskproAn issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify...9.1 Critical
- avast antivirusAn issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx...7.5 High
- mcafee endpoint security, mcafee, llc endpoint security (ens) for window +1 moreENS configuration can be edited by attacker with local administrator permissions6.5 Medium
- tp-link archer a7, ac1750 firmware +1 moreThis vulnerability allows local attackers to escalate privileges on affected installations of TP...5.3 Medium
- cesnet perunLDAP connector injection in Perun6.2 Medium
- [unknown] openshift/mediawiki, redhat openshift +1 moreA vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an...7.0 High
- [unknown] openshift/postgresql-apb, redhat openshift +1 moreA vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an...7.0 High
- red hat openshift/template-service-broker-operator, redhat template service broker operator +1 moreA vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions...7.0 High
- redhat openshift, red hat openshift/installer +1 moreDuring installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates...4.4 Medium
- vmware horizon client, remote console, horizon client for windows +3 more +5 moreFor VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for...7.8 High
- vmware fusion, workstation +1 moreLinux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2...7.8 High
- red hat ansible, fedoraproject fedora, redhat ansible tower +2 more +4 moreIncorrect Permission Assignment for Critical Resource in Ansible2.2 Low
- google androidIn app uninstallation, there is a possible set of permissions that may not be removed from a...7.8 High
- dell xtremio, xtremio management server +1 moreDell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment...6.7 Medium
- gitlabGitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it...8.1 High
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded...6.5 Medium
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The...7.5 High
- red hat openshift/apb-tools-container, redhat openshift container platform +1 moreIt has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1...7.0 High
- wftpserver wing ftp serverAn issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure...7.8 High
- wftpserver wing ftp serverWing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation...7.8 High
- ibm platform lsf, spectrum lsf, spectrum computing suite for high performance analytics +2 more +4 moreIBM Platform LSF 9.1 and 10.1, IBM Spectrum LSF Suite 10.2, and IBM Spectrum Suite for HPA 10.2...7.4 High
- zte corporation e8820v3, zte e8820v3 firmware +1 moreZTE E8820V3 router product is impacted by a permission and access control vulnerability....6.5 Medium
- widgets project widgetsAn issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title...5.4 Medium
- phoenixcontact ilc 2050 bi-l firmware, ilc 2050 bi firmware +1 moreAn issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L...9.4 Critical
- red hat openshift-service-mesh/kiali-rhel7-operator, redhat openshift service mesh +1 moreAn insecure modification vulnerability in the /etc/passwd file was found in all versions of...7.0 High
- iteris vantage velocity firmwareIteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for...9.8 Critical
- codologic codoforumCodologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal...5.4 Medium
- combodo itopIn Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of...8.1 High
- intel manycore platform software stackImproper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an...7.8 High
- codologic codoforumAn issue was discovered in Codologic Codoforum 4.8.4. While creating a new topic as a normal user...6.1 Medium
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +15 more +17 moreAn elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects...7.8 High
- lenovo browserThis vulnerability allows network adjacent attackers to execute arbitrary code on affected...5.5 Medium
- joomla!, joomla joomla\! +1 moreJoomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.5.3 Medium
- trend micro anti-threat toolkit (attk), trendmicro anti-threat toolkit +1 moreTrend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that...7.8 High
- wowza streaming engineA privilege escalation vulnerability in Wowza Streaming Engine 4.7.7 and 4.7.8 allows any...7.8 High
- ricoh generic pcl5 driver, pc fax generic driver, pcl6 driver for universal print +5 more +7 moreAn issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to...7.8 High
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent...5.5 Medium
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other...8.8 High
- apt-cacher-ng project apt-cacher-ng, opensuse leap 15.1, backports +2 moreapt-cacher-ng insecure use of /run/apt-cacher-ng6.2 Medium
- ispconfigISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client...9.8 Critical
- intel intel(r) daal, data analytics acceleration library +1 moreImproper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to...5.5 Medium
- suse keystone-json-assignment, openstack cloud, openstack cloud 8 +1 more +3 morekeystone_json_assignment backend granted access to any project for users in user-project-map.json8.8 High
- centreonInsecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19...7.8 High
- Show moreLoading…