CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- zoll defibrillator dashboardZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem...7.8 High
- google android, samsung mobile devices +1 moreImproper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows...6.6 Medium
- f5 big-ip access policy manager, big-ip access policy manager client, edge client for windows +2 moreOn version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client...7.8 High
- annexcloud loyalty experience platformAnnex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify...4.3 Medium
- intel vtune profilerInsecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before...7.8 High
- intel lapbc510 firmware, lapbc710 firmware +1 moreInsecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before...7.8 High
- intel uniteInsecure inherited permissions in the Intel Unite(R) Client for Windows before version 4.2.25031...7.8 High
- intel lapqc71a firmware, lapqc71b firmware, lapqc71c firmware +1 more +3 moreInsecure inherited permissions for some Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers before...7.8 High
- intel ac 9461 firmware, ac 9462 firmware, ac 9560 firmware +2 more +4 moreInsecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an...7.3 High
- broadcom sannavBrocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and...5.4 Medium
- nmstate kubernetes-nmstate, redhat openshift virtualization +1 moreWithdrawn Advisory: kubernetes-nmstate Insecure Privilege Management7.0 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain...6.5 Medium
- trendmicro maximum security 2021, trend micro maxmium security (consumer) +1 moreThe Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access...7.8 High
- red hat satelliteA flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets...5.5 Medium
- f5 nginx controllerThe Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf...5.5 Medium
- google androidIn doNotification of AccountManagerService.java, there is a possible permission bypass due to an...5.5 Medium
- google androidIn sendBugreportNotification of BugreportProgressService.java, there is a possible permission...7.8 High
- google androidIn getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to...5.5 Medium
- google androidIn archiveStoredConversation of MmsService.java, there is a possible way to archive message...7.8 High
- kubevirtPermissions bypass in KubeVirt6.5 Medium
- umask project umaskPermissions bypass in pleaser7.8 High
- inspircdInspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to...4.3 Medium
- nagios xiCreation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows...9.8 Critical
- nagios fusionIncorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to...8.8 High
- ploneIncorrect Permission Assignment for Critical Resource in Plone9.9 Critical
- solarwinds orion job schedulerThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- ibm security identity managerIBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and...5.4 Medium
- bmc remedy mid-tierBMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the...8.8 High
- vmware tanzu rabbitmq, broadcom rabbitmq server +1 moreRabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions...7.8 High
- ibm qradar user behavior analytics, qradar siem +1 moreIBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due...3.7 Low
- wago 0852-0303, 0852-0303 firmware, 0852-1305 +7 more +9 moreWAGO: Managed Switches: Unsecure Cookie settings5.3 Medium
- microsoft windows 10 version 1809, windows 10 version 1909, windows 10 version 2004 +8 more +10 moreWindows Container Manager Service Elevation of Privilege Vulnerability7.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were...5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was...7.5 High
- cyrus imap, fedoraproject fedora +1 moreCyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to...4.3 Medium
- open-emr openemrThe Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal...8.2 High
- red hat tripleo-ansible, redhat openstack +1 moreA flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log...7.5 High
- btcpayserver btcpay serverBTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information,...5.3 Medium
- google androidIn notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible...7.8 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreSpecially crafted query may result in a denial of service of mongod6.5 Medium
- soyal 701clientSoyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with...8.8 High
- advantech webaccess\/scadaIncorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA...8.8 High
- wowza streaming engineWowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions...7.1 High
- eclipse jersey, the eclipse foundation eclipse jersey, oracle communications cloud native core policy +1 more +3 moreLocal information disclosure via system temporary directory6.2 Medium
- aviatrix controllerInsecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and...7.5 High
- zulip serverAn issue was discovered in Zulip Server before 3.4. A bug in the implementation of the...5.3 Medium
- zulip serverAn issue was discovered in Zulip Server before 3.4. A bug in the implementation of the...4.3 Medium
- zulip serverAn issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to...4.3 Medium
- zulip serverIn the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to...2.7 Low
- forescout counteractAn issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation...7.8 High
- Show moreLoading…