CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- brocade fabric os, broadcom fabric operating system +1 moreA vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4,...6.5 Medium
- anaconda anaconda3, conda miniconda3 +1 moreAnaconda Anaconda3 through 2021.11.0.0 and Miniconda3 through 11.0.0.0 can create a world...7.8 High
- naver whale browser, navercorp whale +1 moreWhale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any...9.8 Critical
- opensuse cscreen, factory +1 moresuddoers configuration for cscreen not restrictive enough5.3 Medium
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 more'Root Service' service implemented in the following Yokogawa Electric products creates some named...7.8 High
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 more'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products...7.8 High
- nvidia jetson linux, jetson nano, jetson nano 2gb +1 moreNVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU...7.6 High
- aternity steelcentral appinternals dynamic sampling agentLocal privilege escalation due to misconfigured write permission on .debug_command.config file7.8 High
- ericsson network managerEricsson Network Manager 20.2 has Insecure Permissions.6.5 Medium
- bitdefender antivirus plus, endpoint security tools for windows, endpoint security tools +2 more +4 moreIncorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)7.8 High
- google chromeInappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a...6.5 Medium
- stepmaniaThe component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the...9.1 Critical
- cherwell service managementAn issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The...5.3 Medium
- osu ohio supercomputer center open ondemandThe Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1...4.3 Medium
- jetbrains hubIn JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with...7.5 High
- google fuchsiaWrite access to VMO data through copy-on-write in Fuchsia7.5 High
- watchguard firewareWatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged...6.5 Medium
- rigoblock dragoRigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This...7.5 High
- argoproj argo cd, redhat openshift gitops +1 moreA flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and...6.5 Medium
- acronis vss doctorLocal privilege escalation due to insecure folder permissions7.8 High
- apache cassandraRemote code execution for scripted UDFs9.1 Critical
- kubernetes cri-o, redhat openshift container platform +1 moreIncorrect Permission Assignment for Critical Resource in CRI-O4.2 Medium
- huawei emuiThere is an improper security permission configuration vulnerability on ACPU.Successful...7.8 High
- abb opc server for ac 800m, 800xa, control software for ac 800m opc server for ac 800m, compact product suite - control and i/o opc server for ac 800m +2 more +4 moreSECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability8.4 High
- globalnorthstar northstar club managementSystemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows...9.8 Critical
- mitre cve servicescontroller/org.controller/org.controller.js in the CVE Services API 1.1.1 before...7.2 High
- mirantis bored-agentImproper header sanitization in bored-agent causes escalation of privilege8.8 High
- delgan delgan/loguru, loguru project loguru +1 moreInsertion of Sensitive Information into Log File in delgan/loguru4.3 Medium
- microweber, microweber microweber/microweber +1 moreIncorrect Permission Assignment for Critical Resource in microweber/microweber6.5 Medium
- onionshareOTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website3.7 Low
- google fuchsiaIncorrect mapping of Executable bits in Fuchsia Kernel5.1 Medium
- western digital edgeroverInsecure file and directory permissions on EdgeRover7.7 High
- zabbix, fedoraproject fedora, zabbix proxy, server +2 moreIncorrect permissions of [/var/run/zabbix] forces dac_override3.3 Low
- jenkins bitbucket branch source, jenkins project bitbucket branch source plugin +1 moreIncorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin4.3 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreIncorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin4.3 Medium
- mitre calderaAn issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges,...8.1 High
- jenkins mailer, jenkins project mailer plugin, oracle communications cloud native core automated test suite +2 moreIncorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin4.3 Medium
- google androidIn sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions...7.8 High
- google androidIn sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions...7.8 High
- leap bitmask riseup vpnBitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access...7.3 High
- netgear genie installerAll known versions of the Netgear Genie Installer for macOS contain a local privilege escalation...7.8 High
- oppo colorosColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default...7.8 High
- groupsession, japan total system co.,ltd. groupsession free edition, groupsession bycloud, groupsession zion +1 moreIncorrect permission assignment for critical resource vulnerability in GroupSession Free edition...7.5 High
- mesa labs amegaviewMesa Labs AmegaView Improper Privilege Management7.8 High
- solarwinds orion, orion platform +1 moreUnrestricted access to Orion.UserSettings SWIS entity for low-privilege users6.8 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +4 more +6 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- fortinet fortinacA incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to…7.8 High
- google android, samsung mobile devices +1 moreAn improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local...4.0 Medium
- mozilla firefoxWebExtensions with the correct permissions were able to create and install ServiceWorkers for...6.5 Medium
- trustedfirmware op-teeThe OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/wri…7.1 High
- Show moreLoading…