CWE-732 · Incorrect Permission Assignment for Critical Resource (page 12)
Page 12 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5895 | High | 7.8 | 2020-05-07 | On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local s… |
CVE-2020-3312 | High | 7.5 | 2020-05-06 | A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gai… |
CVE-2020-11443 | High | 8.1 | 2020-05-04 | The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version… |
CVE-2019-19218 | High | 7.5 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage. |
CVE-2020-12459 | Medium | 5.5 | 2020-04-29 | In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_… |
CVE-2020-12458 | Medium | 5.5 | 2020-04-29 | An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are wo… |
CVE-2020-8473 | High | 7.3 | 2020-04-29 | Insufficient folder permissions used by system functions in ABB System 800xA Base (version 6.1 and earlier) allow low privileged users to read, modify, add and… |
CVE-2020-8472 | Medium | 5.5 | 2020-04-29 | Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Pro… |
CVE-2020-12120 | High | 7.5 | 2020-04-27 | The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can b… |
CVE-2020-4311 | High | 7.0 | 2020-04-23 | IBM Tivoli Monitoring 6.3.0 could allow a local attacker to execute arbitrary code on the system. By placing a specially crafted file, an attacker could exploi… |
CVE-2019-20693 | Medium | 5.4 | 2020-04-16 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC505 before 8.0.6.4 and WAC510 before 8.0.6.4. |
CVE-2020-4347 | High | 7.3 | 2020-04-16 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could be subject to attacks based on privilege escalation due to inappropriate file permissions for file… |
CVE-2020-0557 | High | 7.8 | 2020-04-15 | Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an authenticated user to potentially enab… |
CVE-2020-10699 | High | 7.8 | 2020-04-15 | A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enables the targetcli… |
CVE-2020-10513 | High | 8.8 | 2020-04-15 | The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary… |
CVE-2020-10642 | High | 7.8 | 2020-04-13 | In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the executio… |
CVE-2020-10551 | High | 7.8 | 2020-04-09 | QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users grou… |
CVE-2018-21081 | Critical | 9.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. In Dual Messenger, the second app can use the runtime permissions of the first app with… |
CVE-2020-4289 | Medium | 5.3 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the… |
CVE-2019-4603 | Medium | 4.3 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they wer… |
CVE-2020-11107 | High | 8.8 | 2020-04-02 | An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration i… |
CVE-2020-7263 | Medium | 6.5 | 2020-04-01 | Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alte… |
CVE-2020-10883 | High | 7.8 | 2020-03-25 | This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacke… |
CVE-2020-5281 | Medium | 6.2 | 2020-03-25 | In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3… |
CVE-2020-1709 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was fo… |
CVE-2020-1707 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file w… |
CVE-2020-1705 | High | 7.0 | 2020-03-19 | A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in t… |
CVE-2019-19335 | Medium | 4.4 | 2020-03-18 | During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password… |
CVE-2020-3948 | High | 7.8 | 2020-03-16 | Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to im… |
CVE-2019-5543 | High | 7.8 | 2020-03-16 | For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15… |
CVE-2020-1736 | Low | 2.2 | 2020-03-16 | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world… |
CVE-2019-2089 | High | 7.8 | 2020-03-15 | In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege… |
CVE-2019-18577 | Medium | 6.7 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges… |
CVE-2019-13009 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible… |
CVE-2019-12441 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which res… |
CVE-2020-1706 | High | 7.0 | 2020-03-09 | It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissi… |
CVE-2020-9470 | High | 7.8 | 2020-03-07 | An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the con… |
CVE-2020-8635 | High | 7.8 | 2020-03-07 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to… |
CVE-2020-4278 | High | 7.8 | 2020-03-05 | IBM Platform LSF 9.1 and 10.1, IBM Spectrum LSF Suite 10.2, and IBM Spectrum Suite for HPA 10.2 could allow a local user to escalate their privileges due to we… |
CVE-2020-8768 | Critical | 9.4 | 2020-02-17 | An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read… |
CVE-2020-1704 | High | 7.0 | 2020-02-17 | An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio… |
CVE-2020-9024 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loa… |
CVE-2020-7050 | Medium | 5.4 | 2020-02-15 | Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loade… |
CVE-2019-11215 | High | 8.1 | 2020-02-14 | In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader wit… |
CVE-2020-0563 | High | 7.8 | 2020-02-13 | Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2020-7051 | Medium | 6.1 | 2020-02-13 | Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the Http… |
CVE-2020-0668 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera… |
CVE-2019-13321 | High | 8.0 | 2020-02-10 | This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is… |
CVE-2011-4912 | Medium | 5.3 | 2020-02-04 | Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. |
CVE-2019-20358 | High | 7.8 | 2020-01-30 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2019-7656 | High | 7.8 | 2020-01-29 | A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The install… |
CVE-2019-19363 | High | 7.8 | 2020-01-24 | An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected… |
CVE-2019-19895 | High | 7.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by mod… |
CVE-2019-19894 | Medium | 5.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) ca… |
CVE-2012-2087 | Critical | 9.8 | 2020-01-23 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. |
CVE-2019-14629 | Medium | 5.5 | 2020-01-17 | Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2019-3683 | High | 8.8 | 2020-01-17 | The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/us… |
CVE-2019-20327 | High | 7.8 | 2020-01-16 | Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is… |
CVE-2019-16784 | High | 7.0 | 2020-01-14 | In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstal… |
CVE-2019-19727 | Medium | 5.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. |
CVE-2019-19263 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. |
CVE-2019-19262 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. |
CVE-2019-19087 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). |
CVE-2019-19086 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). |
CVE-2019-19736 | Medium | 6.1 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be u… |
CVE-2019-3467 | High | 7.8 | 2019-12-23 | Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for th… |
CVE-2019-19915 | Critical | 9.0 | 2019-12-19 | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redi… |
CVE-2019-19341 | Medium | 5.5 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET… |
CVE-2019-8256 | Critical | 9.8 | 2019-12-19 | ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could… |
CVE-2019-19882 | High | 7.8 | 2019-12-18 | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs ar… |
CVE-2019-19315 | High | 7.1 | 2019-12-17 | NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMail… |
CVE-2019-9464 | Medium | 5.5 | 2019-12-06 | In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app… |
CVE-2019-17388 | High | 7.8 | 2019-12-05 | Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary… |
CVE-2013-0326 | Medium | 5.5 | 2019-12-05 | OpenStack nova base images permissions are world readable |
CVE-2019-19522 | High | 7.8 | 2019-12-05 | OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the… |
CVE-2019-19382 | High | 7.8 | 2019-12-03 | Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replace a .exe or .dll file to achieve privil… |
CVE-2019-5212 | Medium | 5.5 | 2019-11-29 | There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An… |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2012-6655 | Low | 3.3 | 2019-11-27 | An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords. |
CVE-2019-14812 | High | 7.8 | 2019-11-27 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-18456 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insec… |
CVE-2019-18453 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions. |
CVE-2019-18452 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecu… |
CVE-2019-18450 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions. |
CVE-2019-18449 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2). |
CVE-2019-18447 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions. |
CVE-2019-18446 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2). |
CVE-2019-18459 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of… |
CVE-2019-18463 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4). |
CVE-2019-18462 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions. |
CVE-2019-13681 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML p… |
CVE-2019-13679 | Low | 3.3 | 2019-11-25 | Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file. |
CVE-2019-13677 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML… |
CVE-2019-13676 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13665 | Medium | 6.5 | 2019-11-25 | Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML… |
CVE-2019-4214 | Low | 3.7 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obta… |
CVE-2019-19197 | High | 7.8 | 2019-11-21 | IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execu… |
CVE-2019-16406 | High | 7.8 | 2019-11-21 | Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gai… |
CVE-2019-18958 | High | 7.8 | 2019-11-21 | Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG… |
CVE-2019-14869 | High | 8.8 | 2019-11-15 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabli… |