CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- elastic enterprise searchElastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API...8.8 High
- elastic elasticsearchExposure of sensitive information in Elasticsearch6.5 Medium
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8), visual studio 2019 version 16.11 (includes 16.0 - 16.10), visual studio 2019 version 16.4 (includes 16.0 - 16.3) +4 more +6 moreVisual Studio Elevation of Privilege Vulnerability7.8 High
- pi-hole pi-hole/adminlte, web interface +1 moreSensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte7.4 High
- apple macos, mac os x +1 moreA permissions issue existed in DiskArbitration. This was addressed with additional ownership...7.5 High
- terarecon aquariusnetNMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary...8.8 High
- google androidIn sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due...7.8 High
- solarwinds orion platformImportAlert Improper Access Control Tampering Vulnerability6.3 Medium
- indexhibitA configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files,...8.8 High
- indexhibitAn issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily...6.5 Medium
- canon -Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250...7.5 High
- apple ipados, macos, watchos +2 more +4 moreAn inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to byp…5.5 Medium
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive information.5.5 Medium
- apple macos, mac os x +1 moreAn inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious applicatio…5.5 Medium
- raspapraspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.8.8 High
- yandex browserClickhouse prior to versions v20.8.18.32-lts, v21.1.9.41-stable, v21.2.9.41-stable, v21.3.6.55...7.8 High
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment...7.5 High
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for...7.8 High
- dell emc powerscale onefs, powerscale onefs +1 moreDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for...7.8 High
- docker desktopDocker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is...7.8 High
- cpanelIn cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).5.5 Medium
- sapphireimsIn SapphireIMS 5.0, it is possible to create local administrator on any client with credentials...8.8 High
- sapphireimsIn SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by...6.5 Medium
- sapphireimsIn SapphireIMS 4097_1, a guest user can create a local administrator account on any system that...8.8 High
- canon pixma tr150 firmwareThe Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue....7.8 High
- dell powerscale onefsDell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may...7.8 High
- acronis true imageAcronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to...7.8 High
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a...7.8 High
- redhat libvirt, netapp ontap select deploy administration utility, redhat enterprise linux +1 more +3 moreA flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels...6.3 Medium
- microsoft windows, windows 10 version 1809, windows 10 version 1909 +8 more +10 moreWindows Elevation of Privilege Vulnerability7.8 High
- trend micro apex one, worry-free business security, trend micro, inc. micro worry-free business security +2 moreAn incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex...7.8 High
- lexmark g2 driver, g3 driver, g4 driver +1 more +3 moreThe Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3...7.8 High
- containerd, fedoraproject fedora +1 moreArchive package allows chmod of file outside of unpack target directory5.0 Medium
- rancherrancher: API group not properly specified when creating Kubernetes RBAC resources8.8 High
- ysoft safeqIncorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user...7.8 High
- ibm cloud pak for applicationsIBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges...8.8 High
- siemens simatic pcs 7 v8.2 and earlier, simatic pcs 7 v9.x, simatic pdm +6 more +8 moreA vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS...8.8 High
- nodejs node, node.js, siemens sinec infrastructure network services +2 moreIncorrect Permission Assignment for Critical Resource in Node7.8 High
- ibm urbancode deployIBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 6.2.7.8 , 6.2.7.9, 7.0.3.0, 7.0.4.0, 7.0.5.4, 7.1.0...4.9 Medium
- nica winwaste.netWinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user...7.8 High
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain...3.7 Low
- dell storage managerQSAN Storage Manager - Incorrect Permission Assignment for Critical Resource6.5 Medium
- mediawikiAn issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups...4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreA user without PR can reset user authentication failures information2.0 Low
- google androidIn setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due...7.8 High
- voxmedia coral talkTalk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other...7.5 High
- tibco enterprise runtime for r, spotfire analytics platform, spotfire server +3 more +5 moreTIBCO Spotfire Windows Platform Installation vulnerability8.8 High
- runzero platform, shopware +1 morePrivate files publicly accessible with Cloud Storage providers7.5 High
- ibm db2, db2 for linux and unix +1 moreIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an...6.5 Medium
- moodleMoodle command execution vulnerability exists in the default legacy spellchecker plugin8.2 High
- Show moreLoading…