CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sap netweaver application server abap, sap se netweaver application server abap (sap kernel) +1 moreInformation Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)5.3 Medium
- apache solrApache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users7.5 High
- spring security, vmware spring security +1 moreSpring Security's spring-security.xsd file is world writable4.1 Medium
- qnap qsync centralQsync Central8.0 High
- b&r industrial automation automation studio, net/pvi +1 moreAutomation Studio and PVI Multiple incorrect permission assignments for services8.2 High
- rapid software llc scada, rapidscada rapid scada +1 moreIncorrect Permission Assignment for Critical Resource in Rapid SCADA7.8 High
- spring cloud contract, vmware spring cloud contract +1 moreSpring Cloud Contract vulnerable to local information disclosure3.3 Low
- silverstripe framework, silverstripe-framework +1 moreRecord titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter4.3 Medium
- apple ipados, macos, tvos +3 more +5 moreA privacy issue was addressed with improved handling of files. This issue is fixed in macOS...6.2 Medium
- intel hid event filter driverInsecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some...6.7 Medium
- huawei emui, harmonyos +1 moreVulnerability of permissions being not strictly verified in the WMS module. Successful...7.5 High
- huawei emui, harmonyos +1 morePermission management vulnerability in the multi-screen interaction module. Successful...7.5 High
- gentoo ebuild for slurmpkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign...9.8 Critical
- hongdian h8951-4g-esp, h8951-4g-esp firmware +1 moreCommand execution using the certificate upload utility8.8 High
- melapress wp 2fa – two-factor authentication for wordpress, wpwhitesecurity wp 2fa +1 moreWP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending4.3 Medium
- easysocialfeed easy social feed, sjaved easy social feed – social photos gallery and post feed for wordpress +1 moreEasy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification4.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +15 more +17 moreHypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability4.4 Medium
- siemens spectrum power 7A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected...7.8 High
- zte zxcloud iraiLocal Privilege Escalation Vulnerability of ZTE's ZXCLOUD iRAI6.7 Medium
- google androidIn setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone...5.0 Medium
- phpgurukul online notes sharing systemPHPGurukul Online Notes Sharing System Contact Information profile.php access control4.3 Medium
- phoenix contact axc f 1152, axc f 2152, axc f 3152 +14 more +16 morePHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control8.8 High
- phoenix contact automation worx software suite, axc 1050, axc 1050 xc +30 more +32 morePhoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource9.8 Critical
- phoenix contact multiprog, proconos eclr (sdk), phoenixcontact proconos eclr +2 morePhoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource9.8 Critical
- zte zxcloud iraiWeak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI6.5 Medium
- devolutions remote desktop managerClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on...9.8 Critical
- sap se gui for windows and sap gui for java, sap graphical user interface +1 moreInformation disclosure in SAP GUI for Windows and SAP GUI for Java7.3 High
- sap cloud connectorDenial of service (DOS) in SAP Cloud Connector3.5 Low
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS...5.5 Medium
- mullvad vpnAn issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions...7.8 High
- pyinstallerLocal Privilege Escalation in pyinstaller on Windows8.8 High
- netscout ngeniuspulseNETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability9.1 Critical
- forgejoIn Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a...9.1 Critical
- bd facschorusOverly Permissive Access Policy4.1 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion5.4 Medium
- honeywell prowatchIncorrect Permission assignment to program executable folders7.8 High
- xuxueli xxl-jobxxl-job-admin vulnerable to Insecure Permissions5.4 Medium
- intel nuc pro software suiteInsecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software...6.7 Medium
- intel nuc watchdog timer utilityInsecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before...6.7 Medium
- intel server configuration utility, intel server configuration utility software server configuration utility software +1 moreInsecure inherited permissions in the installer for some Intel Server Configuration Utility...6.7 Medium
- intel simics simulatorInsecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2...6.7 Medium
- intel rapid storage technologyInsecure inherited permissions in some Intel Rapid Storage Technology software before version 16...6.7 Medium
- fortinet fortimailAn improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2...5.3 Medium
- clickstudios passwordstateAn issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security...4.7 Medium
- checkpoint endpoint security, harmony endpoint. +1 moreLocal Privliege Escalation in Check Point Endpoint Security Remediation Service7.8 High
- palo alto networks cortex xsoarCortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine6.4 Medium
- ni topografix dataplugin for gpx, diadem, flexlogger +2 more +4 moreIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPX5.5 Medium
- mayurik inventory management systemSourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect...8.8 High
- apple macosA logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma...6.5 Medium
- busbaer eisbaer scada, eisbaer scada v3.0.6433.1964 +1 moreEisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource7.5 High
- Show moreLoading…