CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- secudos qiataSECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To...7.8 High
- baker hughes - bently nevada bently nevada 3500 system, bakerhughes bentley nevada 3500 system firmware +1 moreBaker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource7.5 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: A local attacker can retrieve sensitive information and elevate privileges on the device to an authorized user.5.0 Medium
- zabbixJavaScript engine memory pointers are directly available for Zabbix users for modification9.1 Critical
- zabbixInefficient permission check in class CControllerAuthenticationUpdate8.5 High
- siemens sicam pas/pqs, sicam pas\/pqs +1 moreA vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The...7.8 High
- siemens sicam pas/pqs, sicam pas\/pqs +1 moreA vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The...6.6 Medium
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application...7.8 High
- eve door and window firmware, govee led strip firmware, nanoleaf lightstrip firmware +6 more +8 moreInsecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0...7.5 High
- mediawikiAn issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through...4.3 Medium
- mediawiki, debian linux +1 moreAn issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1...5.3 Medium
- decidimDecidim has broken access control in templates9.1 Critical
- gradleGradle has incorrect permission assignment for symlinked files used in copy or archiving operations3.2 Low
- hashicorp vault, vault enterprise +1 moreVault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets7.6 High
- cisco catalyst sd-wan manager, sd-wan manager, sd-wan vmanage +2 moreA vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi...7.2 High
- huawei emui, harmonyos +1 moreBroadcast permission control vulnerability in the framework module. Successful exploitation of...5.3 Medium
- huawei emui, harmonyos +1 moreVulnerability of improper permission management in the displayengine module. Successful...5.3 Medium
- adobe connectPrivilage Escalation in Saphira Connect8.8 High
- siemens spectrum power 7A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected...8.2 High
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (promotion management) +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)9.9 Critical
- node.js, nodejs node +1 moreA vulnerability has been identified in Node.js version 20, affecting users of the experimental...5.3 Medium
- qualys container scanning connector, qualys,inc. container scanning connector jenkins plugin +1 moreIncorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier3.1 Low
- wacom driver, drivers for windows +1 moreWacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- gitlabIncorrect Execution-Assigned Permissions in GitLab6.5 Medium
- schweitzer engineering laboratories sel-5033 acselerator rtac software, selinc sel-5033 acselerator real-time automation controller +1 moreInsecure Inherited Permissions7.4 High
- phpjabbers car rental scriptIn PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or...8.8 High
- moxa iologik 4000 series, iologik e4200 firmware +1 moreioLogik 4000 Series: Session Cookies Attribute Not Set Properly3.1 Low
- rails activesupportActive Support Possibly Discloses Locally Encrypted Files5.5 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic) +1 moreA vulnerability in the restricted security domain implementation of Cisco Application Policy...5.4 Medium
- cisco adaptive security appliance (asa) software, firepower extensible operating system (fxos), firepower threat defense software +1 more +3 moreA vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to...4.4 Medium
- cisco firepower extensible operating system (fxos), unified computing system (managed), firepower 4112 firmware +7 more +9 moreA vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software...7.7 High
- escanav escan anti-virusMicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissions7.8 High
- broadcom raid controller web interface, lsi storage authority (lsa), lsi storage authority +2 more +4 moreBroadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file7.5 High
- intel oneapi math kernel libraryInsecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow...6.7 Medium
- opnsenseInsecure permissions exist for configd.socket in OPNsense before 23.7.7.5 High
- opnsenseInsecure permissions in the configuration directory (/conf/) of OPNsense before 23.7 allow...9.8 Critical
- opnsenseOPNsense before 23.7 was discovered to contain insecure permissions in the directory /tmp.7.5 High
- siemens sicam toolbox iiA vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected...7.8 High
- cisco broadworks, broadworks application delivery platform, broadworks application server +10 more +12 moreA vulnerability in the privilege management functionality of all Cisco BroadWorks server types...4.4 Medium
- rust-lang cargo, fedoraproject fedora +1 moreCargo not respecting umask when extracting crate archives7.8 High
- jeesiteAn issue in the delete function in the ActModelController class of jeesite v1.2.6 allows...5.4 Medium
- abb ability™ zenon, zenon +1 moreCode Execution through overwriting service executable in utilities directory7.0 High
- checkpoint endpoint security, harmony endpoint. +1 moreLocal privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted...7.8 High
- sap s4core, sap se s/4hana (manage journal entry template) +1 moreImproper Access Control in SAP S/4HANA (Manage Journal Entry Template)6.3 Medium
- sap sql anywhereDenial of Service (DoS) vulnerability in SAP SQL Anywhere7.8 High
- veritas netbackup applianceIn Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an...6.5 Medium
- ucopia weblib, wireless appliance firmware +1 moreAn issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.7.5 High
- stormshield endpoint securityStormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL...4.3 Medium
- stormshield endpoint securityStormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An...5.5 Medium
- dataeaseDataEase has a privilege bypass vulnerability6.5 Medium
- Show moreLoading…