CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- siemens siport, siport mp +1 moreA vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application...8.5 High
- hasomed elefantLocal Privilege Escalation via Weak Service Binary Permissions7.8 High
- rapid7 velociraptorRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service8.6 High
- akamai secure internet access enterprise threatavertAkamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization...7.1 High
- hashicorp vagrant, vagrant vmware utility +1 moreVagrant VMWare Utility installation files vulnerable to modification by unprivileged user3.8 Low
- nvidia virtual gpu manager, cloud gaming virtual gpu, vgpu and cloud gaming +2 moreNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of...7.1 High
github.com/rancher/rke2GoRKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists9.1 Critical- ovaledgeOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET...7.5 High
- exceedone exmentIncorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier...3.8 Low
- nokia service router operating system, sr os (7250 ixr, 7450 ess, 7750 sr, 7950 ixr, vsr), 7705 sar os, 7210 sas os +1 moreNokia SR OS: File Access Security Vulnerability7.3 High
- tecno com.transsion.aivoiceassistantImproper permission control in the mobile application (com.transsion.aivoiceassistant) can lead...9.8 Critical
- mirotalk p2pIncorrect access control in the component app/src/server.js of Mirotalk before commit 9de226...7.5 High
- ivanti endpoint manager mobileInsecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to...8.8 High
- microfocus verticaIncorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.6.9 Medium
- ruijie rg-nbs2009g-p firmwareInsecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows...9.8 Critical
- hashicorp vault, vault enterprise, vault community edition +1 more +3 moreVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default7.5 High
- ibm aspera consoleIBM Aspera Console information disclosure3.7 Low
- olgu computer systems e-belediyeLocal File Inclusion (LFI) in Olgu Computer Systems' e-Belediye9.4 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could write data to the user's clipboard, bypassing the user prompt, during a certain...7.5 High
- tecno com.afmobi.boomplayerImproper permission configurationDomain configuration vulnerability of the mobile application ...9.8 Critical
- avg internet securityLocal privilege escalation vulnerability in AVG Internet Security7.8 High
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS...3.7 Low
- siemens sinumerik 828d v4, sinumerik 828d v5, sinumerik 840d sl v4 +4 more +6 moreA vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All...9.3 Critical
- external-secrets, external-secrets external secrets operator +1 moreExternal Secrets Operator vulnerable to privilege escalation8.3 High
- vivavis high-leitHIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain...7.8 High
- avaiga taipySession Cookie without Secure and HTTPOnly flags in taipy6.3 Medium
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): Unexpected lax shared memory permissions5.5 Medium
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container6.8 Medium
- froxlorFroxlor before 2.2.0 Insecure File Permissions mysql.conf8.4 High
- rockwell automation thinmanager® thinserver™, rockwellautomation thinmanager +1 moreRockwell Automation ThinManager® ThinServer™ Information Disclosure6.8 Medium
- vipre advanced securityVIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- rockwell automation factorytalk view site edition, rockwellautomation factorytalk view +1 moreRockwell Automation FactoryTalk® View Site Edition Code Execution Vulnerability via File Permissions8.5 High
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Local Privilege Escalation (PE) Vulnerability5.2 Medium
- intel hid event filter driver, nuc m15 laptop kit lapbc510, nuc m15 laptop kit lapbc510 firmware +15 more +17 moreInsecure inherited permissions in some Intel(R) HID Event Filter software installers before...5.4 Medium
- intel flexlm license daemons for intel fpga, fpga add-on +1 moreInsecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before...5.4 Medium
- aveva reports for operations 2023, ocean data systems dream report 2023 +1 moreIncorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report8.5 High
- nagios ndoutilsNagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain...7.8 High
- kubean-io kubeanCluster-level privilege escalation in kubean6.0 Medium
- zexelon zwx-2000csw2-hn firmware, zexelon co., ltd. zwx-2000csw2-hn +1 moreIncorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware...8.0 High
- fogprojectFOG Weak file permissions5.3 Medium
- plug&track thermoscan ipA “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP...7.8 High
- ibm security directory integrator, security verify directory integrator +1 moreIBM Security Directory Integrator information disclosure3.7 Low
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...4.4 Medium
- syrotech sy-gpon-1110-wdont router, sy-gpon-1110-wdont firmware +1 moreCookie Without HTTPOnly Flag Set Vulnerability6.9 Medium
- apinizer, pruvasoft informatics apinizer management console +1 moreBroken Access Control in PruvaSoft Informatics' Apinizer Management Console9.9 Critical
- rockwell automation pavilion8®, rockwellautomation pavilion8 +1 moreRockwell Automation Privilege Escalation Vulnerability in Pavilion8®8.7 High
- tecno com.android.server.telecomImproper permission control in com.android.server.telecom3.3 Low
- openfind mailaudit, mailgates +1 moreOpenfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag5.3 Medium
- cisco ios xr software, ios xr +1 moreA vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local...6.7 Medium
- checkmkPrivilege escalation in Windows agent8.8 High
- Show moreLoading…