CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center Information Disclosure Vulnerability5.5 Medium
- ibm security guardium data encryptionIBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical...4.2 Medium
- ibm spectrum protect plus, spectrum protect +1 moreIBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to...2.9 Low
- pearson vue testing systemThe Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for...7.8 High
- mk-authMK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can...4.8 Medium
- pagelayerAn issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the...7.4 High
- xclonerAn issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It...9.9 Critical
- expresstech quiz and survey masterAn issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made...10.0 Critical
- vasyltech advanced access managerThe Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object...4.3 Medium
- google androidIn several functions of GlobalScreenshot.java, there is a possible permission bypass due to an...5.5 Medium
- apache accumuloApache Accumulo Improper Handling of Insufficient Permissions8.1 High
- 3ds teamwork cloudAn incorrect permission assignment (chmod 777) of /etc/environment during the installation script...7.8 High
- td-agent-builder project td-agent-builder, debian linux +1 moreThe td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges...7.0 High
- dlink dsl2888a firmwareAn issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55....6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier,...4.3 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise...8.1 High
- mediawikiAn issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the...8.8 High
- tenable tenable.scIn certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside...7.5 High
- apache pulsar managerIn the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's...6.5 Medium
- tangro business workflowIn tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document...4.3 Medium
- tangro business workflowIn tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in...6.5 Medium
- tangro business workflowIn tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed...4.3 Medium
- kyland kps2204 6 port managed din-rail programmable serial device firmwareA sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail...9.8 Critical
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read...8.8 High
- adremsoft netcrunchAdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web...9.8 Critical
- google androidIn showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent....5.5 Medium
- google androidIn createSimSelectNotification of SimSelectNotification.java, there is a possible permission...5.5 Medium
- xen, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the...8.8 High
- ni compactrio firmwareIncorrect permissions are set by default for an API entry-point of a specific service, allowing a...7.5 High
- google guava, netapp active iq unified manager, oracle commerce guided search +10 more +12 moreTemp directory permission issue in Guava3.3 Low
- mcafee virusscan enterprise, mcafee, llc virusscan enterprise (vse) +1 moreIncorrect Permission Assignment for Critical Resource6.5 Medium
- umbraco cmsIncorrect permission enforcement in UmbracoCms4.3 Medium
- ibm cloud pak for securityIBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive...4.0 Medium
- x11vnc project x11vnc, debian linux, fedoraproject fedora +2 morescan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other...8.8 High
- redhat gluster-blockAn information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the...5.5 Medium
- vmware sd-wan orchestratorThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1...7.2 High
- hashicorp consulPrivilege Escalation in HashiCorp Consul6.5 Medium
- bigbluebuttonIn BigBlueButton before 2.2.29, a user can vote more than once in a single poll.4.3 Medium
- oppo ovoicemanagerOvoiceManager has system permission to write vulnerability reports for arbitrary files, affected...9.8 Critical
- katacontainers kata-containersAn improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a...7.1 High
- intel nuc 8 mainstream-g kit nuc8i5inh firmware, nuc 8 mainstream-g kit nuc8i7inh firmware, nuc 8 mainstream-g mini pc nuc8i5inh firmware +20 more +22 moreInsecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an...7.8 High
- intel media sdkImproper file permissions in the installer for the Intel(R) Media SDK for Windows before version...7.8 High
- microsoft azure sphereAzure Sphere Information Disclosure Vulnerability6.2 Medium
- bluestacksIncorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to...7.8 High
- tcl 32s330 firmware, 40s330 firmware, 43s434 firmware +4 more +6 moreA vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01...7.8 High
- cisco sd-wan, sd-wan solution +1 moreCisco SD-WAN Software Privilege Escalation Vulnerability7.8 High
- saltstack salt, debian linux +1 moreSaltStack Salt Allows creating certificates with weak file permissions5.5 Medium
- google androidIn callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due...5.5 Medium
- wondershare dr.foneDr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because ...7.8 High
- Show moreLoading…