CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- chocolatey cmderInsecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the...4.3 Medium
- chocolatey rubyInsecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the...4.3 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk Android broadcast incorrect permission handling3.3 Low
- automotive shop management system project shop management systemAutomotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master...6.5 Medium
- wpml, onthegosystems ltd. wpml multilingual cms (wordpress plugin) +1 moreWordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability5.4 Medium
- opcfoundation local discovery serverOPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a...7.8 High
- ibm cics txIBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission...4.0 Medium
- bruhn-newtech cbrn-analysisCBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of...5.9 Medium
- google android, samsung mobile devices +1 moreImproper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022...4.3 Medium
- google android, samsung mobile devices +1 moreImproper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1...4.0 Medium
- acronis cyber protect home officeSensitive information disclosure due to insecure folder permissions. The following products are...2.2 Low
- acronis cyber protect home officeLocal privilege escalation due to insecure folder permissions. The following products are...7.3 High
- acronis cyber protect home officeLocal privilege escalation due to insecure folder permissions. The following products are...7.3 High
- trellix dxl broker, mcafee data exchange layer +1 moreDXL Broker privilege escalation vulnerability6.5 Medium
- hypr workforce accessIncorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on...3.7 Low
- apple macosA permissions issue existed. This issue was addressed with improved permission validation. This...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1...5.5 Medium
- automoxThe Automox Agent before 40 on Windows incorrectly sets permissions on key files.7.8 High
- juniper junos os evolvedJunos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commands7.3 High
- 74cms 74cmsse74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change...6.5 Medium
- gitlabImproper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before...2.7 Low
- codeigniter, codeigniter4 +1 moreSecure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter42.6 Low
- avaya aura application enablement servicesAvaya Aura Application Enablement Services weak permissions in web application7.7 High
- beckmancoulter remisol advanceThe default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol...6.5 Medium
- beckmancoulter remisol advanceThe default privileges for the running service Normand License Manager in Beckman Coulter Remisol...5.5 Medium
- beckmancoulter remisol advanceThe default privileges for the running service Normand Service Manager in Beckman Coulter Remisol...5.5 Medium
- beckmancoulter remisol advanceThe default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol...5.5 Medium
- beckmancoulter remisol advanceThe default privileges for the running service Normand Remisol Advance Launcher in Beckman...5.5 Medium
- actian psql, zen +1 moreIf folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15...8.8 High
- ping identity pingcentralPingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with...5.4 Medium
- bytebasebytebase - Improper Authorization4.3 Medium
- zammadZammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to...4.3 Medium
- brokercap bifrostBifrost users using basic authntication can bypass write permission limit8.5 High
- rocket.chatA cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5...6.5 Medium
- rocket.chatA privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate...4.3 Medium
- crestron airmediaCrestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to...8.8 High
- zapier code by zapierCode by Zapier before 2022-08-17 allowed intra-account privilege escalation that included...9.9 Critical
- debian logcheckIn the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to...9.8 Critical
- kubernetes cri-oCRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure7.1 High
- honeywell softmasterHoneywell SoftMaster Incorrect Permission Assignment for Critical Resource6.2 Medium
- cuppacmsCuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both...8.8 High
- ibm control deskIBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by...3.7 Low
- onedev project onedevPersistent XSS in OneDev5.4 Medium
- siderolabs talos, talos linux +1 moreTalos worker join token can be used to get elevated access level to the Talos API7.2 High
- iobit malware fighterIObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated...6.7 Medium
- pcprotect endpointPCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing...6.7 Medium
- discourseDiscourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an...7.2 High
- apache airflowOverly permissive umask for daemons4.7 Medium
- apache shenyuApache ShenYu Admin Improper Privilege Management8.8 High
- google androidIn the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due...5.5 Medium
- Show moreLoading…