CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- axis camera station proGee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible...5.9 Medium
- zyxel uos, usg flex h series uos firmware +1 moreAn incorrect permission assignment vulnerability in the PostgreSQL commands of the USG FLEX H...7.8 High
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource6.1 Medium
- oracle user managementVulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search...7.5 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported...4.9 Medium
- oracle mysql server, netapp snapcenter +1 moreVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported...4.9 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). ...4.9 Medium
- oracle secure backupVulnerability in Oracle Secure Backup (component: General). Supported versions that are affected...6.7 Medium
- sophos taegis endpoint agent (linux), taegis endpoint agent +1 moreA code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux)...7.8 High
- hewlett packard enterprise (hpe) virtual intranet access (via)Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client5.5 Medium
- splunk app for lookup file editingIncorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File Editing2.5 Low
- beijing honghu yuntu technology fast cad readerDylib Hijacking in Fast CAD Reader8.4 High
- b&r industrial automation gmbh aprolIncorrect Permission Assignment in APROL file system8.5 High
- nasa core flight systemThe Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions,...9.8 Critical
- linuxfoundation pipecdPipeCD Vulnerable to Privilege Escalation9.8 Critical
- dell thinos, wyse proprietary os (modern thinos) +1 moreDell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged...7.8 High
- facebook belowBelow has Incorrect Permission Assignment for Critical Resource6.8 Medium
- ivanti secure access clientInsufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a...7.8 High
- google androidIn handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due...7.5 High
- blackmagic design inc davinci resolveDylib Hijacking in DaVinci Resolve8.4 High
- esri arcgis pro, arcgis allsource +1 moreThere is a code injection vulnerability in ArcGIS Pro7.3 High
- metabaseMetabase Enterprise Edition allows cached questions to leak data to impersonated users4.8 Medium
- ivanti secure access clientInsufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local...7.1 High
- siemens simatic ipc diagbase, simatic ipc diagmonitor +1 moreA vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC...7.3 High
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (central management console) +1 moreImproper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)8.7 High
- sangoma asteriskInsecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary...9.8 Critical
@tanstack/form-corenpm@tanstack/form-core prototype pollution7.5 High- ibm security verify access appliance, security verify access, security verify access container +1 more +3 moreIBM Security Verify Access incorrect privilege assignment5.0 Medium
- No product listedNedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.7.5 High
- freebsdUnprivileged access to system files6.5 Medium
- akamai enterprise application accessAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an...8.0 High
- apache hiveApache Hive: Credentials file created with non restrictive permissions5.5 Medium
- rockwell automation factorytalk® view site editionFactoryTalk® View Site Edition - Incorrect Permission Assignment7.0 High
- cmsimpleInsecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain...7.5 High
- gradle enterpriseDevelocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project...7.1 High
- ecovacs airbot andy firmware, airbot ava firmware, airbot z1 firmware +12 more +14 moreECOVACS lawnmowers and vacuums insecurely store audio warning files1.8 Low
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...7.3 High
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). ...6.5 Medium
- oracle corporation agile plm framework, oracle agile product lifecycle management +1 moreVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile...8.1 High
- oracle solarisVulnerability in the Oracle Solaris product of Oracle Systems (component: File system). The...6.0 Medium
- oracle mysql serverVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported...4.9 Medium
- Show moreLoading…