CWE-732 · Incorrect Permission Assignment for Critical Resource (page 13)
Page 13 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15340 | Low | 3.3 | 2019-11-14 | The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys con… |
CVE-2019-15339 | Low | 3.3 | 2019-11-14 | The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package n… |
CVE-2019-15338 | Low | 3.3 | 2019-11-14 | The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installe… |
CVE-2019-15337 | Low | 3.3 | 2019-11-14 | The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name… |
CVE-2019-15336 | Low | 3.3 | 2019-11-14 | The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0/O11019/1536917928:user/release-keys contains a pre-installed app w… |
CVE-2019-15335 | Low | 3.3 | 2019-11-14 | The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name… |
CVE-2019-15334 | Low | 3.3 | 2019-11-14 | The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0/O11019/1538188945:user/release-keys contains a pre-installed app… |
CVE-2019-15333 | Low | 3.3 | 2019-11-14 | The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package n… |
CVE-2019-11155 | High | 7.1 | 2019-11-14 | Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of s… |
CVE-2019-11154 | High | 7.1 | 2019-11-14 | Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of s… |
CVE-2012-1160 | Low | 2.7 | 2019-11-14 | Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php |
CVE-2019-18895 | High | 7.8 | 2019-11-14 | Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable… |
CVE-2019-1457 | High | 7.8 | 2019-11-12 | A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel S… |
CVE-2019-18856 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use ele… |
CVE-2019-13535 | Medium | 4.6 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-3425 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker cou… |
CVE-2019-3866 | Medium | 5.5 | 2019-11-08 | An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2007-5743 | High | 7.5 | 2019-11-07 | viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. |
CVE-2019-5642 | Low | 3.3 | 2019-11-06 | Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system duri… |
CVE-2019-5068 | Medium | 4.4 | 2019-11-05 | An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared me… |
CVE-2016-4983 | Low | 3.3 | 2019-11-05 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2013-4367 | High | 7.8 | 2019-11-01 | ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.ch… |
CVE-2011-3923 | Critical | 9.8 | 2019-11-01 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. |
CVE-2019-18422 | High | 8.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling… |
CVE-2010-0747 | High | 7.8 | 2019-10-30 | drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725. |
CVE-2010-0737 | High | 8.0 | 2019-10-30 | A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to pe… |
CVE-2016-5202 | Critical | 9.1 | 2019-10-25 | browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux n… |
CVE-2019-18409 | High | 7.8 | 2019-10-24 | The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (whi… |
CVE-2019-18192 | High | 7.8 | 2019-10-17 | GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable… |
CVE-2019-8071 | Critical | 9.8 | 2019-10-17 | Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2019-11167 | High | 7.8 | 2019-10-11 | Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potentially enable esc… |
CVE-2019-11528 | High | 7.5 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable. |
CVE-2019-11526 | Critical | 9.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the… |
CVE-2019-1378 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbi… |
CVE-2019-3765 | High | 8.1 | 2019-10-09 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |
CVE-2019-0073 | Medium | 6.6 | 2019-10-09 | The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user… |
CVE-2019-6465 | Medium | 5.3 | 2019-10-09 | Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-… |
CVE-2015-9456 | Medium | 6.5 | 2019-10-07 | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=or… |
CVE-2019-17051 | High | 7.8 | 2019-09-30 | Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-cl… |
CVE-2019-9378 | High | 7.8 | 2019-09-27 | In the Activity Manager service, there is a possible permission bypass due to incorrect permission check. This could lead to local escalation of privilege with… |
CVE-2019-12245 | Medium | 5.3 | 2019-09-25 | SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in… |
CVE-2019-13356 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allow… |
CVE-2019-13355 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows l… |
CVE-2019-9008 | High | 8.8 | 2019-09-17 | An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime. |
CVE-2019-15721 | Medium | 5.4 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view… |
CVE-2019-11166 | Medium | 6.7 | 2019-09-16 | Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable esc… |
CVE-2019-16354 | Medium | 4.7 | 2019-09-16 | The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory… |
CVE-2019-16187 | High | 7.5 | 2019-09-09 | Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script. |
CVE-2018-18630 | High | 7.8 | 2019-09-06 | A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local… |
CVE-2019-12645 | High | 7.8 | 2019-09-05 | A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, lo… |
CVE-2019-12635 | Medium | 4.3 | 2019-09-05 | A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-15752 | High | 7.8 | 2019-08-28 | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMD… |
CVE-2019-15316 | High | 7.0 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of Crea… |
CVE-2019-15315 | High | 7.8 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of… |
CVE-2019-11806 | Low | 3.3 | 2019-08-20 | OX App Suite 7.10.1 and earlier has Insecure Permissions. |
CVE-2019-13069 | High | 7.8 | 2019-08-17 | extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.conf… |
CVE-2019-7958 | Critical | 9.8 | 2019-08-16 | Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privi… |
CVE-2019-15119 | Medium | 5.5 | 2019-08-16 | lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user. |
CVE-2019-15084 | High | 7.8 | 2019-08-16 | Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result, a local attacker can escalate to SYSTEM. |
CVE-2018-12357 | Medium | 6.5 | 2019-08-15 | Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions. |
CVE-2019-0341 | High | 8.8 | 2019-08-14 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application… |
CVE-2019-12808 | High | 7.8 | 2019-08-13 | ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an e… |
CVE-2019-14969 | High | 7.8 | 2019-08-12 | Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.AD… |
CVE-2019-14935 | High | 7.8 | 2019-08-12 | 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for… |
CVE-2019-1944 | High | 7.3 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-14743 | Medium | 6.6 | 2019-08-07 | In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local… |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2018-20936 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308). |
CVE-2018-20909 | High | 7.1 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). |
CVE-2018-20908 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). |
CVE-2018-20907 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432). |
CVE-2018-20906 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430). |
CVE-2018-20905 | Medium | 5.4 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). |
CVE-2018-20904 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427). |
CVE-2018-20871 | Critical | 9.8 | 2019-07-30 | In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in cer… |
CVE-2019-14395 | Low | 3.3 | 2019-07-30 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). |
CVE-2018-2024 | High | 8.1 | 2019-07-22 | IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended acto… |
CVE-2019-1010101 | Critical | 9.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component… |
CVE-2019-5222 | Medium | 5.5 | 2019-07-17 | There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The… |
CVE-2019-12876 | High | 7.3 | 2019-07-17 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low… |
CVE-2019-1010009 | Critical | 9.8 | 2019-07-15 | DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The a… |
CVE-2019-12577 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-13142 | Medium | 5.5 | 2019-07-09 | The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRA… |
CVE-2019-13208 | High | 7.3 | 2019-07-03 | WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, leading to DLL side l… |
CVE-2018-14862 | Medium | 6.5 | 2019-07-03 | Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal us… |
CVE-2018-14861 | Medium | 6.5 | 2019-07-03 | Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure… |
CVE-2018-14866 | Medium | 4.3 | 2019-07-03 | Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers… |
CVE-2018-14916 | Critical | 9.1 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. |
CVE-2018-14886 | Medium | 4.9 | 2019-06-28 | The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allo… |
CVE-2019-13012 | High | 7.5 | 2019-06-28 | The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and… |
CVE-2019-2023 | High | 7.8 | 2019-06-19 | In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app… |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2018-19446 | High | 7.8 | 2019-06-17 | A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is us… |
CVE-2019-2257 | High | 7.8 | 2019-06-14 | Wrong permissions in configuration file can lead to unauthorized permission in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2018-3702 | High | 7.8 | 2019-06-13 | Improper permissions in the installer for the ITE Tech* Consumer Infrared Driver for Windows 10 versions before 5.4.3.0 may allow an authenticated user to pote… |
CVE-2018-19860 | High | 8.8 | 2019-06-07 | Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly rest… |
CVE-2019-12777 | High | 7.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and pr… |