CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedIncorrect permission assignment for critical resource for some System Firmware Update Utility ...5.4 Medium
- docker desktopDocker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerabilities6.7 Medium
- hcl aionHCL AION is susceptible to Incorrect Permission Assignment for Critical Resource5.5 Medium
- iba systems ibapdaIncorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA10.0 Critical
- winavrWinAVR Version 20100110 - Insecure Folder Permissions7.0 High
- pnpmpnpm has Path Traversal via arbitrary file permission modification6.7 Medium
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.0 High
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10,...5.0 Medium
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path Traversal7.1 High
- cisco intersight virtual applianceCisco Intersight Virtual Appliance Privilege Escalation Vulnerability6.0 Medium
- ibm licensing operatorLicense Service: Privilege escalation vulnerability8.4 High
- laravel valetLaravel Valet 2.0.3 - Local Privilege Escalation (macOS)8.4 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable6.8 Medium
- ludashi driverA local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a...7.3 High
- teamspeakTeamSpeak 3.5.6 - Insecure File Permissions8.5 High
- ruckus networks vriot iot controllerRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE10.0 Critical
- tdmsignage tdm digital signage pc playerTDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions8.5 High
- airvpn eddieEddie VPN 2.24.6 - Local Privilege Escalation8.5 High
- epic games inc. games psyonix rocket leagueEpic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions8.5 High
- sevencs ec2007 kernel, orca g2 +1 moreAn incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The...7.8 High
- inmusicbrands engine dj desktopinMusic Brands Engine DJ 4.3.0 suffers from Insecure Permissions due to exposed HTTP service in...7.5 High
- ross video ltd. dashboardRoss Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions8.5 High
- vipre advanced securityVIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- wondershare mirrorgoWondershare MirrorGo 2.0.11.346 Local Privilege Escalation via Insecure File Permissions8.5 High
- aspemailAspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission Vulnerability8.5 High
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability8.8 High
- debian freedomboxFreedombox before 25.17.1 does not set proper permissions for the backups-data directory,...3.2 Low
- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25...6.1 Medium
- conda miniconda3Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability...7.8 High
- anaconda anaconda3Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability...7.8 High
- nagios xiNagios XI Privilege Escalation via Writable PHP Include Executed with Sudo8.6 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- dr.buho buhontfsBuhoNTFS 1.3.2 - Local Privilege Escalation8.5 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4)....3.3 Low
- fortra goanywhere mft, goanywhere managed file transfer +1 moreCVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT4.2 Medium
- splunk, splunk enterprise +1 moreIncorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade8.0 High
- splunk, splunk enterprise +1 moreIncorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade8.0 High
- mirion medical ec2 software nmis biodose, mirion biodose\/nmis +1 moreMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource8.7 High
- mirion medical ec2 software nmis biodose, mirion biodose\/nmis +1 moreMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource8.6 High
- mirion medical ec2 software nmis biodose, mirion biodose\/nmis +1 moreMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource7.1 High
- asus myasusA local privilege escalation vulnerability exists in the restore mechanism of ASUS System...8.5 High
- bjango istatsiStat Menus 7.10.4 - Local Privilege Escalation8.5 High
- checkmkOverly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output4.8 Medium
- nagios log serverNagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules8.5 High
- siemens spectrum power 4A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The...5.6 Medium
- siemens spectrum power 4A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The...8.5 High
- axis osAn ACAP configuration file has improper permissions and lacks input validation, which could...6.7 Medium
- axis osAn ACAP configuration file has improper permissions, which could allow command injection and...6.7 Medium
- qualys inc agentLocal Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents6.3 Medium
- kubevirtKubeVirt Vulnerable to Arbitrary Host File Read and Write8.5 High
- Show moreLoading…