CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- splunk, splunk universal forwarder, cloud platform +2 moreUniversal Forwarder management services allows remote login by default7.5 High
- softwareag connxIn Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have...6.5 Medium
- siemens xpedition designer vx.2.10, xpedition designer vx.2.11, xpedition designer vx.2.12 +2 more +4 moreA vulnerability has been identified in Xpedition Designer (All versions < VX.2.11). The affected...7.8 High
- powertekpdus basic pdu firmware, piml pdu firmware, pm pdu firmware +4 more +6 morePower Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an...9.8 Critical
- premierethemes log wp mailLog WP_Mail <= 0.1 - Email Logs Publicly Accessible7.5 High
- itarian on-premise, saas platform / on-premise, saas service desk +2 moreITarian - Session cookie not protected by HttpOnly flag7.5 High
- google android, mediatek, inc. mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6758, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6795, mt6797, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6889, mt6890, mt6891, mt6893, mt6895, mt6983, mt6985, mt8321, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn telephony, there is a possible information disclosure due to a missing permission check. This...5.5 Medium
- google android, mediatek, inc. mt6580, mt6735, mt6737, mt6739, mt6753, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8321, mt8666, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn telephony, there is a possible information disclosure due to a missing permission check. This...5.5 Medium
- trend micro apex oneAn incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a...7.8 High
- dedecmsDedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via...6.5 Medium
- apache archivaApache Archiva Arbitrary user password reset vulnerability6.5 Medium
- logrotate project logrotate, fedoraproject fedora +1 moreA vulnerability was found in logrotate in how the state file is created. The state file is used...6.5 Medium
- jfrog artifactoryJFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control,...5.3 Medium
- publify publify/publify, publify project publify +1 moreAuthorization Bypass Through User-Controlled Key in publify/publify9.9 Critical
- acronis agent, cyber protect 15, cyber protect +2 moreSensitive information disclosure due to insecure folder permissions7.5 High
- inhand networks inrouter302, inhandnetworks ir302 firmware +1 moreAn information disclosure vulnerability exists in the web interface session cookie functionality...7.5 High
- fortinet forticlient, forticlientlinux +1 moreAn incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient...6.8 Medium
- checkpoint zonealarmCheck Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges...7.8 High
- ibm robotic process automation, robotic process automation as a service +1 moreIBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically...4.6 Medium
- hcl bigfix webuiHCL BigFix WebUI Cookie missing attributes7.4 High
- hcl notes, hcltech hcl inotes +1 moreHCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart4.6 Medium
- f5 big-ip apm, big-ip apm clients, access policy manager clients +1 more +3 moreOn F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x...7.8 High
- f5 big-ip, big-iq centralized management, big-ip access policy manager +10 more +12 moreOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x...4.9 Medium
- shopxoIncorrect Permission Assignment for Critical Resource in ShopXO9.8 Critical
- miele benchmark programming toolPrivilege Escalation in Miele Benchmark Programming Tool7.3 High
- nextcloud, kiteworks security-advisories +1 moreExposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client2.2 Low
- f5 nginx ingress controllerOn version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls...6.5 Medium
- runzero platform, shopware +1 moreImproper Access Control in shopware8.1 High
- fanuc roboguideICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform6.0 Medium
- amazon ssm agentAmazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows...7.0 High
- oracle banking paymentsVulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications ...5.9 Medium
- vmware identity manager, vrealize automation, workspace one access +2 more +4 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code...7.2 High
- vmware identity manager, vrealize automation, workspace one access +3 more +5 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege...7.8 High
- siemens simatic energy manager basic, simatic energy manager pro +1 moreA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1...7.8 High
- zerotier zerotier/zerotierone, zerotierone +1 moreIncorrect Permission Assignment for Critical Resource in zerotier/zerotierone8.8 High
- zyxel ap configurator (zac), ap configurator +1 moreA local privilege escalation vulnerability caused by incorrect permission assignment in some...7.3 High
- dell vnx2, emc unity operating environment +1 moreDell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability....6.4 Medium
- codesys control rte (for beckhoff cx) sl, control rte (sl), control win (sl) +5 more +7 moreCODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.7.8 High
- synametrics synamanSynaman v5.1 and below was discovered to contain weak file permissions which allows authenticated...7.8 High
- bigantsoft bigant serverBigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.7.5 High
- simplemachines simple machines forumSimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute...7.2 High
- ruoyiIn RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of...6.5 Medium
- jenkins jiratestresultreporter, jenkins project jiratestresultreporter plugin +1 moreMissing permission check in Jenkins JiraTestResultReporter Plugin4.3 Medium
- saltstack saltSaltStack Salt Permissions Bypass8.8 High
- debian linux, moby, fedoraproject fedora +1 more +3 moreDefault inheritable capabilities for linux container should be empty5.9 Medium
- sophos utm, unified threat management +1 moreConfd log files contain local users', including root’s, SHA512crypt password hashes with...3.3 Low
- snapt ariaAn insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to...3.5 Low
- teamwork management system project management systemTMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user...5.9 Medium
- fromsoftware dark souls iiiThe matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow...8.8 High
- apple ipados, macos, watchos +2 more +4 moreDescription: A permissions issue was addressed with improved validation. This issue is fixed in...2.4 Low
- Show moreLoading…