CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to...7.8 High
- ingredient stock management system project stock management systemIngredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6...7.5 High
- wwbn avideoAn information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6...7.5 High
- redhat openshift container platformA flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restri…9.8 Critical
- prinitix cloud print managementPrintix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure...8.8 High
- cybozu office, cybozu, inc. cybozu office +1 moreBrowse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows...4.3 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreOperation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows...4.3 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreOperation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a...4.3 Medium
- giteaGitea allowed assignment of private issues6.5 Medium
- google androidIn Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user...3.5 Low
- google androidIn Wifi, there is a possible way to enable Wifi without permissions due to a missing permission...7.8 High
- google androidIn Midi, there is a possible way to learn about private midi devices due to a permissions bypass....5.5 Medium
- google androidIn Telephony, there is a possible information disclosure due to a missing permission check. This...5.5 Medium
- google androidIn AppWidget, there is a possible way to start an activity from the background due to a missing...7.8 High
- google androidIn Keyguard, there is a missing permission check. This could lead to local escalation of...7.8 High
- google androidIn ActivityManager, there is a possible way to check another process's capabilities due to a...3.3 Low
- ibm spectrum scale data access services, spectrum scale das +1 moreIBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 could allow an authenticated user to insert...6.3 Medium
- moodleIn Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without...4.3 Medium
- atlassian jira service management server, jira service management, jira service management data center +2 moreAffected versions of Atlassian Jira Service Management Server and Data Center allow remote...4.3 Medium
- ovarro tbox, tbox lt2-530 firmware, tbox lt2-532 firmware +6 more +8 moreOvarro TBox Incorrect Permission Assignment for Critical Resource8.8 High
- dataeaseDataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin6.5 Medium
- redhat openstackAn Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat...6.5 Medium
- parallels desktopThis vulnerability allows local attackers to escalate privileges on affected installations of...7.8 High
- sage 300In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300...7.8 High
- google androidIn Car Settings app, the NotificationAccessConfirmationActivity is exported. In...7.5 High
- google androidIn PermissionController, there is a possible way to get and retain permissions without user's...7.8 High
- novastar novaicareAn issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker...8.8 High
- google android, samsung mobile devices +1 moreUse of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows...5.1 Medium
- google android, samsung mobile devices +1 moreImproper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows...6.2 Medium
- mini tmall project tmallMini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper.8.8 High
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreImproper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreImproper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreBrowse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu...5.4 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreOperation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreOperation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a...4.3 Medium
- gitlabImproper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14...3.1 Low
- gitlabA critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to...9.9 Critical
- redhat openshift-origin-node-utilIt was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log...5.5 Medium
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 morePingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances7.7 High
- nomachineIncorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2...7.3 High
- nagios xiIn Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is...6.5 Medium
- online student rate system project student rate systemA vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an...9.8 Critical
- ibm jazz team serverIBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to...3.7 Low
- ibm jazz team serverIBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to...3.7 Low
- zhyd oneblogInsecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of...6.5 Medium
- abb rex640 pcl1, rex640 pcl2, rex640 pcl3 +3 more +5 moreABB Relion REX640 Insufficient file access control6.5 Medium
- southrivertech titan ftp server nextgenAn issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing,...7.8 High
- adaware protectInsecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate...7.8 High
- yandex browserLocal privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local,...7.8 High
- Show moreLoading…