CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- schneider electric c-bus toolkitA CWE-269: Improper Privilege Management vulnerability exists in C-Bus Toolkit (V1.15.7 and prior...7.8 High
- trend micro apex one, officescan +1 moreAn insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and...5.5 Medium
- trend micro apex one, officescan +1 moreAn incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service...7.8 High
- trend micro apex one, officescan +1 moreAn improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a...7.8 High
- trend micro apex one, officescan +1 moreAn improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a...7.8 High
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2....4.3 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreAn issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When...4.3 Medium
- openiamOpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions,...9.8 Critical
- acquia mauticMautic vulnerable to secret data exfiltration via symfony parameters5.8 Medium
- grafanaGrafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor...7.1 High
- tenable nessus agentNessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role...6.7 Medium
- utimaco block-safe firmware, cryptoserver cp5 firmware, cryptoserver cp5 vs-nfd firmware +3 more +5 moreMultiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with...7.8 High
- portainerPortainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead...8.8 High
- debian courier-authlib, linux +1 moreThe Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a ...7.5 High
- bloomreach experience managerAn issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows...7.2 High
- microsoft windows 10, windows 10 version 2004, windows 10 version 20h2 +3 more +5 moreWindows 10 Update Assistant Elevation of Privilege Vulnerability7.3 High
- smartbear swagger-codegenGenerated Code Contains Local Information Disclosure Vulnerability5.3 Medium
- google androidIn getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due...7.8 High
- google androidIn deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit...7.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a...6.5 Medium
- sfcyazilim sonloggerSonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g.,...8.2 High
- google androidIn various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of...7.8 High
- weberpIn webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter,...6.5 Medium
- ge ifix, general electric (ge) hmi/scada ifix +1 moreHMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide...5.5 Medium
- ge ifix, general electric (ge) hmi/scada ifix +1 moreHMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide...5.5 Medium
- 74cmsIn 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin...9.8 Critical
- intel compute stick stk1a32sc firmwareInsecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version...7.8 High
- elecom co.,ltd. ld-ps/u1, elecom ld-ps\/u1 firmware +1 moreImproper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the...7.5 High
- suse caas platform, caas platform 4.5 +1 moreskuba: Insecure handling of private key2.9 Low
- mcafee total protection (mtp), total protection, mcafee,llc mcafee total protection (mtp) +2 moreMcAfee Total Protection (MTP) privilege escalation vulnerability8.2 High
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation...5.5 Medium
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for...7.0 High
- psypraxAn issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the...8.1 High
- psypraxAn issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini...5.5 Medium
- zulip desktopZulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone...5.3 Medium
- solarwinds serv-uIn SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files ...7.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for...3.8 Low
- jetbrains youtrackIn JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked...5.3 Medium
- jetbrains hubIn JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other...6.5 Medium
- google androidIn onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a...7.8 High
- google androidIn onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app...7.8 High
- apache druidAuthenticated users can override system configurations in their requests which allows them to execute arbitrary code.8.8 High
- opendoas project opendoasThere is an unsafe incomplete reset of PATH in OpenDoas 6.6 through 6.8 when changing the user...8.8 High
- missionlabs smartagentSmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#...8.8 High
- apache traffic controlCache Manipulation Attack in Apache Traffic Control5.8 Medium
- google androidIn checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access...5.5 Medium
- google androidIn checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions...5.5 Medium
- fastify fastify-csrfCross-site Request Forgery (CSRF)5.9 Medium
- hgiga oaklouds portal, oaksv20 oaklouds-document v3, oaksv30 oaklouds-document v3 +2 moreHGiga OAKloud Portal - Security Misconfiguration5.3 Medium
- Show moreLoading…