CWE-732 · Incorrect Permission Assignment for Critical Resource (page 10)
Page 10 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33093 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticat… |
CVE-2021-33091 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to pot… |
CVE-2021-42955 | High | 7.3 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the de… |
CVE-2021-42954 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable… |
CVE-2020-4146 | Medium | 5.3 | 2021-11-12 | IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker cou… |
CVE-2021-37207 | High | 7.8 | 2021-11-09 | A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder con… |
CVE-2021-41170 | Critical | 9.8 | 2021-11-08 | neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a… |
CVE-2021-20526 | Medium | 5.3 | 2021-10-27 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker cou… |
CVE-2021-41589 | Critical | 9.8 | 2021-10-27 | In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the… |
CVE-2021-37364 | High | 7.8 | 2021-10-26 | OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A l… |
CVE-2021-40343 | High | 7.8 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the… |
CVE-2021-38475 | High | 7.3 | 2021-10-22 | The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissions. |
CVE-2020-14263 | Low | 3.9 | 2021-10-21 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2021-31377 | Medium | 5.5 | 2021-10-19 | An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to… |
CVE-2021-26589 | Medium | 6.1 | 2021-10-19 | A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripti… |
CVE-2021-41802 | Low | 2.9 | 2021-10-08 | HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another u… |
CVE-2021-34758 | Medium | 4.4 | 2021-10-06 | A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, loc… |
CVE-2021-20264 | High | 7.8 | 2021-10-06 | An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the c… |
CVE-2021-0692 | High | 7.8 | 2021-10-06 | In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalati… |
CVE-2021-41091 | Medium | 6.3 | 2021-10-04 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typical… |
CVE-2021-39868 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modif… |
CVE-2021-3747 | High | 8.8 | 2021-10-01 | The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. |
CVE-2021-35202 | Medium | 4.3 | 2021-09-30 | NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService. |
CVE-2021-34410 | High | 7.8 | 2021-09-27 | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows f… |
CVE-2021-34409 | High | 7.8 | 2021-09-27 | It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom… |
CVE-2021-40067 | Medium | 6.8 | 2021-09-16 | The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled… |
CVE-2021-40066 | Medium | 5.3 | 2021-09-16 | The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credenti… |
CVE-2021-39210 | Medium | 6.5 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remem… |
CVE-2021-26434 | High | 7.8 | 2021-09-15 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2021-22149 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using… |
CVE-2021-22148 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This… |
CVE-2021-22147 | Medium | 6.5 | 2021-09-15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to… |
CVE-2021-3706 | High | 7.5 | 2021-09-15 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag |
CVE-2021-35508 | High | 8.8 | 2021-09-01 | NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exp… |
CVE-2020-18121 | High | 8.8 | 2021-08-30 | A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. |
CVE-2021-38154 | High | 7.5 | 2021-08-29 | Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remot… |
CVE-2021-30964 | Medium | 5.5 | 2021-08-24 | An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A… |
CVE-2021-30920 | Medium | 5.5 | 2021-08-24 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive inform… |
CVE-2021-30892 | Medium | 5.5 | 2021-08-24 | An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, mac… |
CVE-2021-38557 | High | 8.8 | 2021-08-24 | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/r… |
CVE-2021-25263 | High | 7.8 | 2021-08-17 | Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2021-36281 | High | 7.5 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially… |
CVE-2021-36280 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-36279 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-37841 | High | 7.8 | 2021-08-12 | Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it… |
CVE-2021-38590 | Medium | 5.5 | 2021-08-11 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). |
CVE-2017-16631 | Medium | 6.5 | 2021-08-11 | In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Reference (IDOR) in the "Ac… |
CVE-2017-16630 | High | 8.8 | 2021-08-11 | In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object… |
CVE-2021-38085 | High | 7.8 | 2021-08-11 | The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CN… |
CVE-2021-21567 | High | 7.8 | 2021-08-10 | Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PR… |
CVE-2021-32577 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. |
CVE-2021-30577 | High | 7.8 | 2021-08-03 | Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a craf… |
CVE-2021-32463 | High | 7.8 | 2021-07-20 | An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Business Security 10.0 SP1… |
CVE-2021-32760 | Medium | 5.0 | 2021-07-19 | containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container i… |
CVE-2021-35449 | High | 7.8 | 2021-07-19 | The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are af… |
CVE-2021-25318 | High | 8.8 | 2021-07-15 | A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to… |
CVE-2021-31859 | High | 7.8 | 2021-07-14 | Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an… |
CVE-2020-0417 | High | 7.8 | 2021-07-14 | In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local esc… |
CVE-2021-20423 | High | 8.8 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308. |
CVE-2021-31894 | High | 8.8 | 2021-07-13 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions <… |
CVE-2021-22921 | High | 7.8 | 2021-07-12 | Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specificall… |
CVE-2021-34110 | High | 7.8 | 2021-07-08 | WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be… |
CVE-2021-20416 | Medium | 5.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly… |
CVE-2021-32526 | Medium | 6.5 | 2021-07-07 | Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access arbitrary password… |
CVE-2021-36129 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggrega… |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-23275 | High | 8.8 | 2021-06-29 | The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, T… |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2020-4945 | High | 8.1 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group perm… |
CVE-2021-0552 | Medium | 5.5 | 2021-06-22 | In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information d… |
CVE-2021-0572 | Medium | 5.5 | 2021-06-22 | In doNotification of AccountManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information dis… |
CVE-2021-0570 | High | 7.8 | 2021-06-22 | In sendBugreportNotification of BugreportProgressService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local e… |
CVE-2021-27483 | High | 7.8 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate… |
CVE-2021-0477 | High | 7.8 | 2021-06-11 | In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to lo… |
CVE-2021-25393 | Medium | 6.6 | 2021-06-11 | Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. |
CVE-2021-23022 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and fold… |
CVE-2021-31929 | Medium | 4.3 | 2021-06-10 | Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupo… |
CVE-2021-0102 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escal… |
CVE-2021-0077 | High | 7.8 | 2021-06-09 | Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enab… |
CVE-2021-0056 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potential… |
CVE-2021-0055 | High | 7.8 | 2021-06-09 | Insecure inherited permissions for some Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers before version 10.42 may allow an authenticated user to potentially enabl… |
CVE-2021-0105 | High | 7.3 | 2021-06-09 | Insecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an authenticated user to potentially enable information disclosure and d… |
CVE-2020-1742 | High | 7.0 | 2021-06-07 | An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could us… |
CVE-2021-32460 | High | 7.8 | 2021-06-03 | The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer which could allow a loc… |
CVE-2020-14335 | Medium | 5.5 | 2021-06-02 | A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attack… |
CVE-2021-23021 | Medium | 5.5 | 2021-06-01 | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. |
CVE-2020-1701 | Medium | 6.5 | 2021-05-27 | A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create V… |
CVE-2021-31155 | High | 7.8 | 2021-05-27 | Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command. |
CVE-2021-33586 | Medium | 4.3 | 2021-05-27 | InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issu… |
CVE-2020-28910 | Critical | 9.8 | 2021-05-24 | Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are… |
CVE-2020-28909 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are abl… |
CVE-2021-33509 | Critical | 9.9 | 2021-05-21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. |
CVE-2021-31475 | High | 8.8 | 2021-05-21 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication… |
CVE-2017-17677 | High | 8.8 | 2021-05-19 | BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code. |
CVE-2021-22117 | High | 7.8 | 2021-05-18 | RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesys… |
CVE-2021-20996 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties. |
CVE-2021-31167 | High | 7.8 | 2021-05-11 | Windows Container Manager Service Elevation of Privilege Vulnerability |
CVE-2021-31907 | Medium | 5.3 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. |
CVE-2021-31902 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. |
CVE-2021-32056 | Medium | 4.3 | 2021-05-10 | Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and c… |