CWE-732 · Incorrect Permission Assignment for Critical Resource (page 11)
Page 11 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32101 | High | 8.2 | 2021-05-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an… |
CVE-2021-31918 | High | 7.5 | 2021-05-06 | A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creatio… |
CVE-2021-29247 | Medium | 5.3 | 2021-05-05 | BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie. |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2021-28269 | High | 8.8 | 2021-04-27 | Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. |
CVE-2021-22669 | High | 8.8 | 2021-04-26 | Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allo… |
CVE-2021-31540 | High | 7.1 | 2021-04-23 | Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local… |
CVE-2020-27568 | High | 7.5 | 2021-04-21 | Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All… |
CVE-2021-28098 | High | 7.8 | 2021-04-14 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector ru… |
CVE-2021-22716 | High | 7.8 | 2021-04-13 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies… |
CVE-2021-28646 | Medium | 5.5 | 2021-04-13 | An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of… |
CVE-2021-28645 | High | 7.8 | 2021-04-13 | An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate… |
CVE-2021-25253 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service cou… |
CVE-2021-25250 | High | 7.8 | 2021-04-13 | An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a loc… |
CVE-2020-26155 | High | 7.8 | 2021-03-18 | Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for… |
CVE-2020-24263 | High | 8.8 | 2021-03-16 | Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed… |
CVE-2021-28374 | High | 7.5 | 2021-03-15 | The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowi… |
CVE-2021-27070 | High | 7.3 | 2021-03-11 | Windows 10 Update Assistant Elevation of Privilege Vulnerability |
CVE-2021-21364 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-0372 | High | 7.8 | 2021-03-10 | In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalatio… |
CVE-2021-21177 | Medium | 6.5 | 2021-03-09 | Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2019-18243 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privil… |
CVE-2019-18255 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow pri… |
CVE-2021-0109 | High | 7.8 | 2021-02-17 | Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escal… |
CVE-2020-8029 | Low | 2.9 | 2021-02-11 | A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet ke… |
CVE-2021-0336 | High | 7.8 | 2021-02-10 | In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. This could lead to local escalation of… |
CVE-2021-0334 | High | 7.8 | 2021-02-10 | In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This cou… |
CVE-2021-23874 | High | 8.2 | 2021-02-10 | Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitra… |
CVE-2020-26196 | Medium | 5.5 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploi… |
CVE-2020-26194 | High | 7.0 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin… |
CVE-2020-10553 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the appl… |
CVE-2021-25276 | High | 7.1 | 2021-02-03 | In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable an… |
CVE-2021-3165 | High | 8.8 | 2021-01-26 | SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI. |
CVE-2020-17522 | Medium | 5.8 | 2021-01-26 | When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that a… |
CVE-2020-28482 | Medium | 5.9 | 2021-01-19 | This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path… |
CVE-2021-22850 | Medium | 5.3 | 2021-01-19 | HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. |
CVE-2021-1126 | Medium | 5.5 | 2021-01-13 | A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view cred… |
CVE-2019-4702 | High | 8.1 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or mod… |
CVE-2021-0304 | Medium | 5.5 | 2021-01-11 | In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information discl… |
CVE-2020-36154 | High | 7.8 | 2021-01-04 | The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which all… |
CVE-2021-21494 | Medium | 4.8 | 2021-01-04 | MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie… |
CVE-2020-25507 | High | 7.8 | 2020-12-28 | An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary cod… |
CVE-2020-28169 | High | 7.0 | 2020-12-24 | The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a fi… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2018-15645 | Medium | 6.5 | 2020-12-22 | Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create… |
CVE-2020-25011 | Critical | 9.8 | 2020-12-17 | A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2020-25191 | High | 7.5 | 2020-12-11 | Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboo… |
CVE-2020-8908 | Low | 3.3 | 2020-12-10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor… |
CVE-2020-7337 | Medium | 6.5 | 2020-12-09 | Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to b… |
CVE-2020-4625 | Medium | 5.3 | 2020-11-30 | IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remot… |
CVE-2020-29074 | High | 8.8 | 2020-11-25 | scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user. |
CVE-2020-10762 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording… |
CVE-2020-11831 | Critical | 9.8 | 2020-11-19 | OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1. |
CVE-2020-28914 | High | 7.1 | 2020-11-17 | An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or direc… |
CVE-2020-24525 | High | 7.8 | 2020-11-12 | Insecure inherited permissions in firmware update tool for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2019-11121 | High | 7.8 | 2020-11-12 | Improper file permissions in the installer for the Intel(R) Media SDK for Windows before version 2019 R1 may allow an authenticated user to potentially enable… |
CVE-2020-16990 | Medium | 6.2 | 2020-11-11 | Azure Sphere Information Disclosure Vulnerability |
CVE-2020-24367 | High | 7.8 | 2020-11-10 | Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that is later executed by… |
CVE-2020-28055 | High | 7.8 | 2020-11-10 | A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows a… |
CVE-2020-3595 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. T… |
CVE-2020-17490 | Medium | 5.5 | 2020-11-06 | The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. |
CVE-2020-15708 | Critical | 9.3 | 2020-11-06 | Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary fi… |
CVE-2020-27992 | High | 7.8 | 2020-11-02 | Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wondershare\dr.fone\Library\DriverInstalle… |
CVE-2020-27658 | High | 7.1 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for rem… |
CVE-2020-26133 | High | 7.8 | 2020-10-28 | An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate pr… |
CVE-2020-26132 | High | 7.8 | 2020-10-28 | An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privile… |
CVE-2020-26131 | High | 7.8 | 2020-10-28 | Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default ins… |
CVE-2020-26130 | High | 7.8 | 2020-10-28 | Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default ins… |
CVE-2020-10140 | High | 7.8 | 2020-10-21 | Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramD… |
CVE-2020-15910 | Medium | 4.7 | 2020-10-19 | SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascrip… |
CVE-2020-0410 | Medium | 5.5 | 2020-10-14 | In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with… |
CVE-2020-17415 | High | 7.8 | 2020-10-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker must first obtain the… |
CVE-2020-17414 | High | 7.8 | 2020-10-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must first obtain the abil… |
CVE-2020-15250 | Medium | 4.4 | 2020-10-12 | In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the sy… |
CVE-2020-26932 | Medium | 4.3 | 2020-10-10 | debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode… |
CVE-2020-15838 | High | 8.8 | 2020-10-09 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. |
CVE-2020-9048 | High | 7.1 | 2020-10-08 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker… |
CVE-2020-12302 | High | 7.8 | 2020-10-05 | Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2020-26106 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). |
CVE-2020-17365 | High | 7.8 | 2020-09-24 | Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable esca… |
CVE-2020-3503 | Medium | 6.0 | 2020-09-24 | A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critica… |
CVE-2020-12842 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php. |
CVE-2020-12839 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php. |
CVE-2020-12838 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php. |
CVE-2020-25826 | High | 7.8 | 2020-09-23 | PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe. |
CVE-2020-16202 | High | 7.8 | 2020-09-22 | WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system… |
CVE-2020-11855 | High | 7.8 | 2020-09-22 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attack… |
CVE-2020-15776 | High | 8.8 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An a… |
CVE-2020-1694 | Medium | 4.9 | 2020-09-16 | A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users… |
CVE-2014-10402 | Medium | 6.1 | 2020-09-16 | An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_… |
CVE-2020-10781 | Medium | 5.5 | 2020-09-16 | A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-co… |
CVE-2014-10401 | Medium | 6.1 | 2020-09-11 | An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_d… |
CVE-2020-7314 | High | 8.2 | 2020-09-10 | Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer (DXL) Client for Mac shipped with McAfee Agent (MA) for Mac prior to MA 5.6.6… |
CVE-2018-17766 | Medium | 4.6 | 2020-09-09 | Ingenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N. |
CVE-2020-23834 | High | 8.8 | 2020-09-04 | Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing t… |
CVE-2020-5369 | High | 8.8 | 2020-09-02 | Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability. An authenticated mal… |
CVE-2020-24355 | Critical | 9.8 | 2020-09-02 | Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular an… |
CVE-2020-17402 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must fir… |
CVE-2020-5417 | High | 8.8 | 2020-08-21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the… |