CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dtstack taierAn insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows...7.5 High
- apache tomcatApache Tomcat: AJP response header mix-up7.5 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDefault permissions for a properties file were too permissive. Local system users could read...3.2 Low
- huawei harmonyosVulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of...8.2 High
- ibm security directory suite vaIBM Security Directory Suite VA information disclosure5.3 Medium
- publiccmsPublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.9.8 Critical
- temenos cwxBroken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows...5.4 Medium
- jenkins aws codecommit trigger, jenkins project aws codecommit trigger plugin +1 moreArbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin6.5 Medium
- discourseDiscourse's general category permissions could be set back to default2.0 Low
- siemens sicam p850, sicam p855, sicam t +1 more +3 moreA vulnerability has been identified in POWER METER SICAM Q200 family (All versions < V2.70)....5.5 Medium
- siemens simatic wincc, wincc +1 moreA vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected...7.8 High
- abb rex640 pcl1, rex640 pcl2, rex640 pcl3 +3 more +5 moreSession cookie exposure for client side script3.1 Low
- sap netweaver, sap se netweaver (change and transport system) +1 moreDenial of Service in SAP NetWeaver2.7 Low
- hutoolInsecure Temporary File in HuTool7.1 High
- contec conprosys hmi system, contec co., ltd. conprosys hmi system (chs) +1 moreIncorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS)...7.8 High
- google androidIn multiple files, there is a possible way to access traces in the dev mode due to a permissions...5.5 Medium
- faronics insightAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote...7.3 High
- mediawikiAn issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x...4.3 Medium
- yank-note yank noteYank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via...8.8 High
- wondershare mobiletransInsecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local...7.8 High
- apache inlongApache InLong: IDOR make users can delete others' subscription7.5 High
- apache inlongApache InLong: IDOR make users can bind any cluster7.5 High
- lightbend akka httpWhen Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll...4.7 Medium
- huawei emui, harmonyos +1 moreThe window management module lacks permission verification.Successful exploitation of this...7.5 High
- opentext documentum content serverOpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation...7.8 High
- jenkins tag profiler, jenkins project tag profiler plugin +1 moreJenkins Tag Profiler Plugin missing permission check4.3 Medium
- jenkins saml single sign on, jenkins project saml single sign on(sso) plugin +1 moreJenkins SAML Single Sign On(SSO) Plugin missing permission checks8.8 High
- jenkins azure vm agents, jenkins project azure vm agents plugin +1 moreJenkins Azure VM Agents Plugin missing permission checks6.5 Medium
- jenkins file parameters, jenkins project file parameter plugin +1 moreJenkins File Parameter Plugin arbitrary file write vulnerability8.8 High
- jenkins email extension, jenkins project email extension plugin +1 moreJenkins Email Extension Plugin missing permission check4.3 Medium
- planet, planetlabs planet-client-python +1 morePlanet's secret file is created with excessive permissions5.2 Medium
- ibm api connectIBM API Connect improper access control4.3 Medium
- cassianetworks access controllerCassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged ...5.3 Medium
- intel quickassist technologyIncorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows...6.5 Medium
- intel quickassist technologyIncorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows...8.2 High
- intel nuc software studio serviceInsecure inherited permissions in the Intel(R) NUC Software Studio Service installer before...6.7 Medium
- intel nuc pro software suiteInsecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may...6.7 Medium
- intel vtune profilerInsecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0...6.7 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15...9.6 Critical
- apache ranger, apache software foundation ranger hive plugin +1 morePermissions problem in the Apache Ranger Hive Plugin8.1 High
- dell command \| monitor, command monitor (dcm) +1 moreDell Command Monitor, versions 10.9 and prior, contains an improper folder permission...7.3 High
- garo wallbox glb firmware, wallbox gtb firmware, wallbox gtc firmware +2 moreInsecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows...8.1 High
- genomedics millegpgAn issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute...7.8 High
- hypr workforce accessIncorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on...7.0 High
- nvidia sbios, dgx servers +1 moreNVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM...7.5 High
- ui desktopA permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could...5.5 Medium
- discourseMultisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse4.2 Medium
- checkmk gmbh appliance, tribe29 checkmk, checkmk appliance +2 morePrivilege escalation in Checkmk Appliance8.8 High
- juniper junos os evolvedJunos OS Evolved: Docker repository is world-writeable, allowing low-privileged local user to inject files into Docker containers8.2 High
- linuxfoundation cubefsCubeFS allows Kubernetes cluster-level privilege escalation6.5 Medium
- Show moreLoading…