CWE-732 · Incorrect Permission Assignment for Critical Resource (page 10)
Page 10 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32760 | Medium | 5.0 | 2021-07-19 | containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container i… |
CVE-2021-35449 | High | 7.8 | 2021-07-19 | The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are af… |
CVE-2021-25318 | High | 8.8 | 2021-07-15 | A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to… |
CVE-2021-31859 | High | 7.8 | 2021-07-14 | Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an… |
CVE-2020-0417 | High | 7.8 | 2021-07-14 | In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local esc… |
CVE-2021-20423 | High | 8.8 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308. |
CVE-2021-31894 | High | 8.8 | 2021-07-13 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions <… |
CVE-2021-22921 | High | 7.8 | 2021-07-12 | Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specificall… |
CVE-2021-34110 | High | 7.8 | 2021-07-08 | WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be… |
CVE-2021-20416 | Medium | 5.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly… |
CVE-2021-32526 | Medium | 6.5 | 2021-07-07 | Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password… |
CVE-2021-36129 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggrega… |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-23275 | High | 8.8 | 2021-06-29 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, T… |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2020-4945 | High | 8.1 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group perm… |
CVE-2021-0552 | Medium | 5.5 | 2021-06-22 | In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information d… |
CVE-2021-0572 | Medium | 5.5 | 2021-06-22 | In doNotification of AccountManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information dis… |
CVE-2021-0570 | High | 7.8 | 2021-06-22 | In sendBugreportNotification of BugreportProgressService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local e… |
CVE-2021-27483 | High | 7.8 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate… |
CVE-2021-0477 | High | 7.8 | 2021-06-11 | In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to lo… |
CVE-2021-25393 | Medium | 6.6 | 2021-06-11 | Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. |
CVE-2021-23022 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and fold… |
CVE-2021-31929 | Medium | 4.3 | 2021-06-10 | Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupo… |
CVE-2021-0102 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escal… |
CVE-2021-0077 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enab… |
CVE-2021-0056 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potential… |
CVE-2021-0055 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for some Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers before version 10.42 may allow an authenticated user to potentially enabl… |
CVE-2021-0105 | High | 7.3 | 2021-06-09 | Insecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an authenticated user to potentially enable information disclosure and d… |
CVE-2020-1742 | High | 7.0 | 2021-06-07 | An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could us… |
CVE-2021-32460 | High | 7.8 | 2021-06-03 | The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer which could allow a loc… |
CVE-2020-14335 | Medium | 5.5 | 2021-06-02 | A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attack… |
CVE-2021-23021 | Medium | 5.5 | 2021-06-01 | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. |
CVE-2020-1701 | Medium | 6.5 | 2021-05-27 | A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create V… |
CVE-2021-31155 | High | 7.8 | 2021-05-27 | Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command. |
CVE-2021-33586 | Medium | 4.3 | 2021-05-27 | InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issu… |
CVE-2020-28910 | Critical | 9.8 | 2021-05-24 | Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are… |
CVE-2020-28909 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are abl… |
CVE-2021-33509 | Critical | 9.9 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. |
CVE-2021-31475 | High | 8.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication… |
CVE-2017-17677 | High | 8.8 | 2021-05-19 | BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code. |
CVE-2021-22117 | High | 7.8 | 2021-05-18 | RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesys… |
CVE-2021-20996 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties. |
CVE-2021-31167 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-31907 | Medium | 5.3 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. |
CVE-2021-31902 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. |
CVE-2021-32056 | Medium | 4.3 | 2021-05-10 | Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and c… |
CVE-2021-32101 | High | 8.2 | 2021-05-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an… |
CVE-2021-31918 | High | 7.5 | 2021-05-06 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creatio… |
CVE-2021-29247 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie. |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2021-28269 | High | 8.8 | 2021-04-27 | Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. |
CVE-2021-22669 | High | 8.8 | 2021-04-26 | Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allo… |
CVE-2021-31540 | High | 7.1 | 2021-04-23 | Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local… |
CVE-2020-27568 | High | 7.5 | 2021-04-21 | Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All… |
CVE-2021-28098 | High | 7.8 | 2021-04-14 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector ru… |
CVE-2021-22716 | High | 7.8 | 2021-04-13 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies… |
CVE-2021-28646 | Medium | 5.5 | 2021-04-13 | An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of… |
CVE-2021-28645 | High | 7.8 | 2021-04-13 | An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate… |
CVE-2021-25253 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service cou… |
CVE-2021-25250 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a loc… |
CVE-2020-26155 | High | 7.8 | 2021-03-18 | Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for… |
CVE-2020-24263 | High | 8.8 | 2021-03-16 | Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed… |
CVE-2021-28374 | High | 7.5 | 2021-03-15 | The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowi… |
CVE-2021-27070 | High | 7.3 | 2021-03-11 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-21364 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-0372 | High | 7.8 | 2021-03-10 | In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalatio… |
CVE-2021-21177 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2019-18243 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privil… |
CVE-2019-18255 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow pri… |
CVE-2021-0109 | High | 7.8 | 2021-02-17 | Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escal… |
CVE-2020-8029 | Low | 2.9 | 2021-02-11 | A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet ke… |
CVE-2021-0336 | High | 7.8 | 2021-02-10 | In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. This could lead to local escalation of… |
CVE-2021-0334 | High | 7.8 | 2021-02-10 | In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This cou… |
CVE-2021-23874 | High | 8.2 | 2021-02-10 | Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitra… |
CVE-2020-26196 | Medium | 5.5 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploi… |
CVE-2020-26194 | High | 7.0 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin… |
CVE-2020-10553 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the appl… |
CVE-2021-25276 | High | 7.1 | 2021-02-03 | In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable an… |
CVE-2021-3165 | High | 8.8 | 2021-01-26 | SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI. |
CVE-2020-17522 | Medium | 5.8 | 2021-01-26 | When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that a… |
CVE-2020-28482 | Medium | 5.9 | 2021-01-19 | This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path… |
CVE-2021-22850 | Medium | 5.3 | 2021-01-19 | HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. |
CVE-2021-1126 | Medium | 5.5 | 2021-01-13 | A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view cred… |
CVE-2019-4702 | High | 8.1 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or mod… |
CVE-2021-0304 | Medium | 5.5 | 2021-01-11 | In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information discl… |
CVE-2020-36154 | High | 7.8 | 2021-01-04 | The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which all… |
CVE-2021-21494 | Medium | 4.8 | 2021-01-04 | MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie… |
CVE-2020-25507 | High | 7.8 | 2020-12-28 | An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary cod… |
CVE-2020-28169 | High | 7.0 | 2020-12-24 | The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a fi… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2018-15645 | Medium | 6.5 | 2020-12-22 | Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create… |
CVE-2020-25011 | Critical | 9.8 | 2020-12-17 | A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2020-25191 | High | 7.5 | 2020-12-11 | Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboo… |
CVE-2020-8908 | Low | 3.3 | 2020-12-10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor… |
CVE-2020-7337 | Medium | 6.5 | 2020-12-09 | Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to b… |
CVE-2020-4625 | Medium | 5.3 | 2020-11-30 | IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remot… |
CVE-2020-29074 | High | 8.8 | 2020-11-25 | scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user. |
CVE-2020-10762 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording… |