CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- huawei harmonyosThere is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone...5.3 Medium
- tmate tmate-ssh-serverWorld-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a...7.0 High
- kaseya unitrends backupAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file...7.8 High
- sun ehrdSunnet eHRD - Broken Access Control8.8 High
- google androidIn SRAMROM, there is a possible permission bypass due to an insecure permission setting. This...6.7 Medium
- concretecms concrete cmsAn issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to...7.2 High
- portswigger burp suitePortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for...6.5 Medium
- hashicorp vaultHashiCorp Vault Incorrect Permission Assignment for Critical Resource6.5 Medium
- business-dna solutions gmbh topeaseMissing HTTPOnly flag on sensitive cookie in TopEase8.1 High
- metagauss download pluginDownload Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation5.7 Medium
- adobe creative cloud (desktop component), creative cloud desktop application +1 moreAdobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability7.8 High
- apache ozoneAccess mode of block tokens are not enforced6.5 Medium
- puppet continuous deliveryA flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user...8.1 High
- intel 7265 firmware, ac 3165 firmware, ac 3168 firmware +9 more +11 moreInsecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for...7.8 High
- intel nuc m15 laptop kit keyboard led service driver packInsecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED...7.8 High
- intel nuc m15 laptop kit serial io driver packInsecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO...7.8 High
- intel nuc m15 laptop kit audio driver packInsecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver...7.8 High
- zohocorp manageengine remote access plusZoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by...7.3 High
- zohocorp manageengine remote access plusZoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by...7.8 High
- ibm security siteprotector systemIBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive...4.0 Medium
- siemens sentron powermanager v3, sentron powermanager 3 +1 moreA vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected...7.8 High
- samba, fedoraproject fedora +1 moreA flaw was found in the way samba, as an Active Directory Domain Controller, is able to support...8.8 High
- neoan neoan3-templateEvaluation of closures can lead to execution of methods & functions in current program scope9.8 Critical
- youphptubeAVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged...7.2 High
- google androidIn getAlias of BluetoothDevice.java, there is a possible way to create misleading permission...5.5 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused...3.7 Low
- gradle build cache node, enterprise +1 moreIn Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is...9.8 Critical
- openclinic ga project gaOpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users...7.8 High
- nagios xiAn issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py...7.8 High
- auvesy versiondogAUVESY Versiondog7.3 High
- hcltech traveler companion"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the...3.9 Low
- juniper junos, juniper networks junos os +1 moreJunos OS: A local authenticated attacker can cause RPD to core5.5 Medium
- hpe superdome flex server, superdome flex 280 firmware, superdome flex firmware +2 moreA potential security vulnerability has been identified in HPE Superdome Flex Servers. The...6.1 Medium
- otrsAgents are able to lock the ticket without the "Owner" permission3.5 Low
- hashicorp vaultHashicorp Vault Privilege Escalation Vulnerability2.9 Low
- tad book3Tad Book3 - Improper Authorization9.1 Critical
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerability4.4 Medium
- oracle openjdkAn insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11...7.8 High
- gitlabIn all versions of GitLab EE since version 14.1, due to an insecure direct object reference...4.3 Medium
- moby, fedoraproject fedora +1 moreInsufficiently restricted permissions on data directory in Docker Engine6.3 Medium
- gitlabIn all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious...4.3 Medium
- emlogemlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.6.5 Medium
- canonical multipassMacOS version of Multipass incorrect owner for application directory8.8 High
- netscout ngeniusoneNETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint)...4.3 Medium
- zoom plugin for microsoft outlookA user-writable application bundle unpacked during the install for all versions of the Zoom...7.8 High
- zoom meetings, rooms, zoom video communications inc client for meetings for macos (standard and for it admin) +3 more +5 moreZoom Client Installer Local Privilege Escalation7.8 High
- netmotionsoftware mobilityThe access controls on the Mobility read-write API improperly validate user access permissions;...6.8 Medium
- netmotionsoftware mobilityThe access controls on the Mobility read-only API improperly validate user access permissions....5.3 Medium
- glpi-project glpiAutologin cookie accessible by scripts6.5 Medium
- elastic enterprise searchElastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API...8.8 High
- Show moreLoading…