CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost serverMattermost Server does not prevent System Admin from arbitrary file creation4.9 Medium
- mattermost serverMattermost Server has mishandled webhook access control4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially...5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only....4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can...5.4 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a...5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non...5.3 Medium
- red hat ansible towerAn exposure of sensitive information flaw was found in Ansible Tower before version 3.7.1....6.5 Medium
- debian linux, linux kernel +1 moreA flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with...5.5 Medium
- treck tcp\/ipThe Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.5.3 Medium
- geti2p i2pI2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file...7.8 High
- dell encryption, encryption enterprise, endpoint security suite enterprise +2 moreDell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7...6.7 Medium
- webroot endpoint agentsWebroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG...7.8 High
- vmware horizon client, horizon client for windows +1 moreVMware Horizon Client for Windows (prior to 5.4.3) contains a privilege escalation vulnerability...7.8 High
- hashicorp consulIncorrect Permission Assignment for Critical Resource in Hashicorp Consul5.3 Medium
- mids\' reborn hero designer project reborn hero designerMids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and...7.8 High
- microsoft windows defender, forefront endpoint protection 2010, forefront endpoint protection +44 more +46 moreAn elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file...7.8 High
- apple macos, mac os x +1 moreAn access issue was addressed with improved access restrictions. This issue is fixed in macOS...5.5 Medium
- qbik wingateWinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local...7.8 High
- debian linux, linuxtv xawtv, canonical ubuntu linux +3 more +5 moreAn issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does...4.4 Medium
- solarwinds advanced monitoring agentSolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a...7.3 High
- pydio cellsIn Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link...5.4 Medium
- smartdraw 2020In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated...8.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +15 more +17 moreConnected User Experiences and Telemetry Service Denial of Service Vulnerability5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +15 more +17 moreConnected User Experiences and Telemetry Service Denial of Service Vulnerability5.5 Medium
- microsoft edge, edge (edgehtml-based) +1 moreMicrosoft Edge Elevation of Privilege Vulnerability5.4 Medium
- splashtop software updater, streamer +1 moreA Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16....6.6 Medium
- amd atillk64An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys...6.7 Medium
- amd overdriveAn issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr...9.8 Critical
- brainstormforce ultimate addons for elementorAn issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress...7.2 High
- linuxfoundation free range routing** DISPUTED ** An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1....5.3 Medium
- fedoraproject fedora, nextcloud group folders +1 moreImproper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when...8.1 High
- f5 nginx controllerOn NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions...7.8 High
- cisco firepower threat defense software, secure firewall management center +1 moreCisco Firepower Threat Defense Software Information Disclosure Vulnerability5.8 Medium
- zoom it installerThe MSI installer in Zoom before 4.6.10 on Windows follows Symbolic Links.8.1 High
- bmcsoftware control-m\/agentBMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.8.8 High
- bmcsoftware control-m\/agentBMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.7.5 High
- grafana, fedoraproject fedora, redhat ceph storage +1 more +3 moreGrafana information disclosure5.5 Medium
- grafana, fedoraproject fedora +1 moreGrafana world readable configuration files5.5 Medium
- abb system 800xa base, 800xa base system +1 moreABB System 800xA Weak File Permissions - ABB System 800xA Base7.3 High
- abb base software for softcontrol, base software, control builder m professional +5 more +7 moreABB System 800xA Weak File Permissions - different products5.5 Medium
- prestashop correos expressThe Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain...7.5 High
- ibm tivoli monitoringIBM Tivoli Monitoring 6.3.0 could allow a local attacker to execute arbitrary code on the system....7.4 High
- ibm infosphere information serverIBM InfoSphere Information Server 11.3, 11.5, and 11.7 could be subject to attacks based on...7.3 High
- netgear wac505 firmware, wac510 firmware +1 moreCertain NETGEAR devices are affected by incorrect configuration of security settings. This...5.4 Medium
- intel proset\/wireless wifi, intel corporation intel(r) proset/wireless wifi software +1 moreInsecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on...7.8 High
- icatch inc. dvr firmware, icatchinc dvr interface +1 moreiCatch DVR - Broken Access Control8.8 High
- Show moreLoading…