CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chrome, debian linux, opensuse backports sle +1 more +3 moreInsufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a...6.5 Medium
- trend micro deep security, trend micro, inc. micro deep security, trendmicro vulnerability protection +2 more +4 moreA vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro...7.2 High
- openzfsOpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.7.8 High
- parallels desktopThis vulnerability allows local attackers to disclose sensitive information on affected...6.5 Medium
- cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 moreCloud Controller may allow developers to claim sensitive routes8.5 High
- elementor website builderElementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode...6.5 Medium
- linux kernel, canonical ubuntu linux, opensuse leap +2 more +4 moreIn the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions...7.1 High
- dell encryption, encryption enterprise, endpoint security suite enterprise +2 moreDell Encryption versions prior to 10.8 and Dell Endpoint Security Suite versions prior to 2.8...6.7 Medium
- trousers project trousers, fedoraproject fedora +1 moreAn issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...7.8 High
- trousers project trousers, fedoraproject fedora +1 moreAn issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...7.8 High
- intel ac 3165 firmware, ac 3168 firmware, ac 7265 firmware +73 more +75 moreInsecure inherited permissions in some Intel(R) PROSet/Wireless WiFi products on Windows* 7 and 8...7.8 High
- intel compute module hns2600bp firmware, compute module hns2600kp firmware, compute module hns2600tp firmware +15 more +17 moreIncorrect execution-assigned permissions in the file system for some Intel(R) Server Boards,...8.8 High
- sap adaptive server enterpriseUnder certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to...7.0 High
- ubuntu libvirt, canonical ubuntu linux +1 moreLibvirt Service Arbitrary File Write Privilege Escalation Vulnerability9.3 Critical
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on...5.1 Medium
- wowza streaming engineWowza Streaming Engine through 2019-11-28 has Insecure Permissions.7.8 High
- sonatype nexus repository managerSonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.8.8 High
- ruckuswireless unleashed firmwareInsecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a...7.5 High
- riverbed steelcentral aternity agentSteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running...7.8 High
- canonical trust-store (ubuntu rtm), trust-store (ubuntu), trust-store \(ubuntu\) +1 more +3 moreLocation service uses cached authorization even after revocation5.0 Medium
- adobe creative cloud desktop applicationAdobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file...9.8 Critical
- joomla joomla\!An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table...4.3 Medium
- gog galaxyIn GOG Galaxy 1.2.67, there is a service that is vulnerable to weak file/service permissions:...7.8 High
- sap disclosure managementSome sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag,...6.3 Medium
- dell emc isilon onefs, isilon onefs, emc powerscale onefs +2 moreDell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a...8.0 High
- gog galaxyAn issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible...7.8 High
- gog galaxyAn issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible...7.8 High
- ibm db2, db2 for linux- unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5...5.1 Medium
- ifax hylafax enterprise, hylafax\+ project hylafax\+ +1 moreHylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories...7.8 High
- baxter sigma spectrum infusion system firmwareThe Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) telnet Command-Line Interface,...9.4 Critical
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.5.3 Medium
- zyxel cloudcnm secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.5.3 Medium
- mattermost serverMattermost Server exposes account details to any Team Administrator4.3 Medium
- mattermost serverMattermost Server allows System Admin to modify LDAP account names and email addresses2.7 Low
- mattermost serverAn issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be...5.3 Medium
- mattermost serverMattermost Server has Improper Authorization for Integration Requests5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications...4.3 Medium
- mattermost serverMattermost Server does not properly restrict use of slash commands8.8 High
- mattermost serverMattermost Server has intermittent Authorization bypass for resource-owners8.1 High
- mattermost serverMattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint5.3 Medium
- mattermost serverMattermost Server allows users with a session ID to revoke another users' session4.3 Medium
- mattermost serverMattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite...4.3 Medium
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin...5.3 Medium
- mattermost serverMattermost Server is vulnerable to Path Traversal when files are stored locally4.9 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the...4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access...4.3 Medium
- Show moreLoading…