CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- synology router manager, router manager (srm) +1 moreSynology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set...7.1 High
- winstonprivacy winston firmwareWinston 1.5.4 devices have an SSH user account with access from bastion hosts. This is...9.8 Critical
- winstonprivacy winston firmwareWinston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root...7.8 High
- winstonprivacy winston firmwareWinston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.6.8 Medium
- dual dhcp dns server project dhcp dns serverAn issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in...7.8 High
- home dns server project dns serverAn issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the...7.8 High
- open dhcp server project dhcp serverIssues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0...7.8 High
- open tftp server project tftp serverIssues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1...7.8 High
- acronis true imageAcronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory....7.8 High
- solarwinds n-centralSolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly....4.7 Medium
- foxit phantompdf, foxitsoftware foxit reader +1 moreThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- foxit reader, foxitsoftware foxit reader, phantompdf +2 moreThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- junit junit4, apache pluto, debian linux +1 more +3 moreInformation disclosure in JUnit44.4 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2...4.9 Medium
- connectwise automateThe Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because...8.8 High
- johnsoncontrols victor web client, johnson controls victor web client version 5.4.1 and prior, tyco c-cure web client +2 morevictor Web Client - Arbitrary File Deletion Vulnerability7.1 High
- sympa, debian linux +1 moredebian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for...4.3 Medium
- intel corporation intel(r) driver & support assistant, intel driver \& support assistant +1 moreImproper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may...7.8 High
- google androidIn setNotification of SapServer.java, there is a possible permission bypass due to a...5.5 Medium
- google androidIn showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due...5.5 Medium
- google androidIn updateMwi of NotificationMgr.java, there is a possible permission bypass due to a...5.5 Medium
- zohocorp manageengine application control plusAn issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element...4.3 Medium
- cpanelcPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC...7.5 High
- pango hotspot shieldImproper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and...7.8 High
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Guest Shell Unauthorized File System Access Vulnerability6.0 Medium
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron...9.8 Critical
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron...9.8 Critical
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron...9.8 Critical
- pingidentity pingid integration for windows loginPingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by...7.8 High
- advantech webaccess, webaccess node +1 moreWebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by...7.8 High
- ibm data risk managerIBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and...8.8 High
- microfocus operation bridge reporterAn Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version...7.8 High
- google androidIn the audio server, there is a missing permission check. This could lead to local escalation of...7.8 High
- gradle enterpriseAn issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. CSRF mitigation can be bypassed...8.8 High
- keycloakIncorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak4.9 Medium
- sylabs singularity, opensuse leap +1 moreInsecure permissions on build temporary rootfs in Singularity8.8 High
- sylabs singularity, opensuse leap +1 moreInsecure permissions on user namespace / fakeroot temporary rootfs in Singularity8.1 High
- perl dbiAn issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open...6.1 Medium
- debian linux, linux kernel, opensuse leap +2 moreThe rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used...4.1 Medium
- perl dbiAn issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files...6.1 Medium
- microsoft powershell, powershell 7.0, powershell 7.1 +18 more +20 moreWindows Defender Application Control Security Feature Bypass Vulnerability6.7 Medium
- microsoft windows 10 version 1607, windows 10 version 1709, windows 10 version 1709 for 32-bit systems +15 more +17 moreWindows Hyper-V Denial of Service Vulnerability6.5 Medium
- microsoft windows 10 version 2004, windows server version 2004, windows 10 +1 more +3 moreProjected Filesystem Security Feature Bypass Vulnerability5.3 Medium
- mcafee agent, mcafee llc dxl for mac shipped with ma +1 morePrivilege Escalation vulnerability in McAfee DXL for Mac8.2 High
- ingenico telium 2 firmwareIngenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol...4.6 Medium
- realtimelogic barracudadriveInsecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow...8.8 High
- dell emc isilon onefs, emc powerscale onefs, isilon onefs +2 moreDell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0...8.8 High
- forlogic qualiexForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via...8.8 High
- zyxel vmg5313-b30b firmwareZyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of...9.8 Critical
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote...6.5 Medium
- Show moreLoading…