CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- devolutions remote desktop managerNo access control for the OTP key on OTP entries4.3 Medium
- fortinet forticlient, forticlientwindows +1 moreMultiple vulnerabilities including an incorrect permission assignment for critical resource [CWE...7.3 High
- gnu screensocket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms...6.5 Medium
- supermicro h11dsi-nt firmware, h11dsi firmware, h11dst-b firmware +143 more +145 moreSupermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.5.5 Medium
- imaworldhealth bhimaBhima version 1.27.0 allows an authenticated attacker with regular user permissions to update...4.3 Medium
- hitachi vantara pentaho business analytics server, hitachi vantara pentaho business analytics server +1 moreHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource8.8 High
- samsung exynos 1080 firmware, exynos 5123 firmware, exynos 5300 firmware +1 more +3 moreAn issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem...3.1 Low
- sambaA flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but...4.3 Medium
- robodkRoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories...7.9 High
- nextcloud server, kiteworks security-advisories +1 moreDelete permissions are not saved when creating public share in Nextcloud server3.5 Low
- delta electronics infrasuite device masterIn Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set...7.8 High
- opengoofy hippo4jHippo4j allows attacker to obtain sensitive info via ConfigVerifyController function of Tenant Management module6.5 Medium
- red hat tripleo-ansible, redhat openstack, openstack tripleo ansible +1 more +3 moretripleo-ansible may disclose important configuration details from an OpenStack deployment5.5 Medium
- red hat tripleo-ansible, redhat openstack, openstack tripleo ansible +1 more +3 moretripleo-ansible may disclose important configuration details from an OpenStack deployment5.5 Medium
- dash10 oauth server, unknown wp oauth server (oauth authentication) +1 moreWP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion4.3 Medium
- opengoofy hippo4jExposure of Sensitive Information in OpenGoofy Hippo4j6.5 Medium
- iteachyou dreamer cmsPermissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to...5.3 Medium
- azure setup-kubectl, microsoft azure setup kubectl +1 moreAzure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower3.9 Low
- zbt we1626 firmwareAn Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06...7.5 High
- clash project clashClash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
- sir gnuboardGnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password...7.5 High
- php-fusionAn issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a...8.1 High
- intel oneapi-cliInsecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0...7.5 High
- johnson controls system configuration tool (sct), johnsoncontrols metasys system configuration tool +1 moreSensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)7.5 High
- nextcloud richdocuments, kiteworks security-advisories +1 moreDocument content of files can be obtained through Collabora for files of other users5.8 Medium
- jeecgInsecure Permissions issue in jeecg-boot7.5 High
- jeecgInsecure Permissions issue in jeecg-boot7.5 High
- jeecgInsecure Permissions issue in jeecg-boot7.5 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +11 more +13 moreiControl REST and tmsh vulnerability4.9 Medium
- schneider electric apc easy ups online monitoring software, easy ups online monitoring software +1 moreA CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could...7.8 High
- netscout ngeniusoneImproper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote...8.8 High
- dentsplysirona sidexisDentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.7.8 High
- glpi-project glpiglpi vulnerable to Unauthorized access to data export6.5 Medium
- ibm robotic process automation for cloud pakIBM Robotic Process Automation for Cloud Pak insufficient permission settings4.0 Medium
- dell command\|configure, command configure (dcc) +1 moreDell command configuration, version 4.8 and prior, contains improper folder permission when...7.3 High
- eternal terminal project terminal, fedoraproject fedora +1 moreIn Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.5.3 Medium
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39...5.5 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15...5.5 Medium
- exfo bv-10 performance endpoint unit, bv-10 firmware +1 moreEXFO - BV-10 Performance Endpoint Unit Misconfiguration6.2 Medium
- google androidIn exported content providers of ShannonRcs, there is a possible way to get access to protected...5.5 Medium
- openstackA privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git...8.8 High
- daloradius, lirantal lirantal/daloradius +1 moreSensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius5.3 Medium
- silverstripe subsitesSilverStripe Subsite weakens file permissions7.5 High
- siemens simcenter star-ccm+, star-ccm\+ +1 moreA vulnerability has been identified in Simcenter STAR-CCM+ (All versions). The affected...7.8 High
- hasura graphql engineHasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for...8.8 High
- zte otcp firmwareZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper...6.5 Medium
- g810-led project g810-led, debian linux +1 moreg810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to...6.5 Medium
- chocolatey phpInsecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the...4.3 Medium
- chocolatey azure-pipelines-agentInsecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all...4.3 Medium
- chocolatey python3Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the...4.3 Medium
- Show moreLoading…