CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....5.3 Medium
- canonical snap, snapd +1 moresnapd allows $HOME/bin symlink6.3 Medium
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains a denial-of-service vulnerability. A malicious actor with network...5.3 Medium
- suse rancherRancher's External RoleTemplates can lead to privilege escalation7.5 High
- rancherRancher's External RoleTemplates can lead to privilege escalation7.5 High
- tecno com.transsion.carlcareImproper permission settings in com.transsion.carlcare9.8 Critical
- rockwell automation factorytalk® view se, rockwellautomation factorytalk view +1 moreRockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File Permissions8.5 High
- linksys velop whw0101 firmware, whw01v1 firmware +1 moreInsecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate...6.8 Medium
- ideabox creations powerpack pro for elementor, powerpack pro for elementor, ideabox powerpack addons for elementor +2 morePowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation8.8 High
- a10 thunder adc, a10networks advanced core operating system +1 moreA10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- esmind, llc mosp kintai kanriIncorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker with access to the product to alter the pr…7.5 High
- qnap qts, quts hero +1 moreQTS, QuTS hero6.4 Medium
- intel extreme tuning utilityInsecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow...6.7 Medium
- nozomi networks arcSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.05.2 Medium
- nozomi networks arcUnsafe temporary data privileges on Unix systems in Arc before v1.6.07.3 High
- ge healthcare echopac software only, echopac turnkey, imagevault +2 more +4 moreNon privileged access to critical file vulnerability in GE HealthCare EchoPAC products6.8 Medium
- ge healthcare invenia abus, invenia abus 2.0, logiq e +19 more +21 moreElevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices7.4 High
- phoenix winflash driver, phoenixtech winflash +1 moreWinFlash Driver Permissions Issue7.8 High
- siemens simatic rtls locating managerA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All...9.4 Critical
- siemens simatic rtls locating managerA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All...5.2 Medium
- ibm security guardiumIBM Security Guardium privilege escalation7.8 High
- voltronic power viewpowerVoltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- lg simple editorLG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- checkpoint harmony endpoint security client for windows, harmony endpoint +1 moreLocal privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file6.7 Medium
- havelsan dialogueBroken Access Control in Havelsan's Dialogue9.4 Critical
- guangzhou yingshi electronic technology ncast yingshiInsecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi...9.8 Critical
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpm-ostree: world-readable /etc/shadow file6.2 Medium
- git-ecosystem git-credential-managerGit Credential Manager (GCM)'s Debian package does not set root ownership on installed files6.9 Medium
- broadcom brocade sannav, brocade sannav +1 moreBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files5.7 Medium
- checkpoint identity agent, zonealarm extreme security nextgen, identity agent for windows, identity agent for windows terminal server, zonealarm extreme security +2 more +4 moreLocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile7.3 High
- oracle peoplesoft enterprise hcm benefits administrationVulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle...6.1 Medium
- hclsoftware devops deploy, ibm urbancode deploy +1 moreIBM UrbanCode Deploy improper privilege control4.4 Medium
- sap businessobjects web intelligenceInformation Disclosure vulnerability in SAP BusinessObjects Web Intelligence7.7 High
- huawei emui, harmonyos +1 morePermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this...6.5 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the clock module. Impact: Successful exploitation of this...7.5 High
- huawei harmonyosThe SystemUI module has a vulnerability in permission management. Impact: Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of improper permission control in the window management module. Impact: Successful...7.5 High
- canonical pebblePebble service manager's file pull API allows access by any user6.5 Medium
- axigen mail serverAn issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows...6.7 Medium
- dell grab, grab for windows +1 moreDell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions...5.5 Medium
- wixtoolset project burn, haxtheweb issues +1 moreWiX based installers are vulnerable to binary hijack when run as SYSTEM7.3 High
- abematv, inc. 'abema' app for androidImproper export of Android application components issue exists in 'ABEMA' App for Android prior...3.3 Low
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +11 more +13 moreHypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability7.8 High
- sap se netweaver (enterprise portal), sap netweaver enterprise portal +1 moreInformation Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)5.3 Medium
- sap netweaver process integration, sap se netweaver process integration (support web pages) +1 moreInformation Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)5.3 Medium
- sap netweaver, sap se netweaver (wsrm) +1 moreInformation Disclosure vulnerability in NetWeaver (WSRM)5.3 Medium
- danielparks dp-golang, puppet-golang +1 moredp-golang Go installation could be owned by wrong user7.3 High
- rockwell automation factorytalk® service platform, rockwellautomation factorytalk services platform +1 moreRockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality9.0 Critical
- suse container suse/manager/5.0/x86 64/server:5.0.0-beta1.2.122, opensuse leap 15.5, opensuse tumbleweed +20 more +22 moretomcat packaging allows for escalation to root from tomcat user7.8 High
- intel administrative tools for intel network adapters, ethernet connections boot utility\, preboot images\, and efi drivers +1 moreInsecure inherited permissions in some Intel(R) Ethernet tools and driver install software may...6.7 Medium
- Show moreLoading…