CWE-732 · Incorrect Permission Assignment for Critical Resource (page 13)
Page 13 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13321 | High | 8.0 | 2020-02-10 | This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is… |
CVE-2011-4912 | Medium | 5.3 | 2020-02-04 | Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. |
CVE-2019-20358 | High | 7.8 | 2020-01-30 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2019-7656 | High | 7.8 | 2020-01-29 | A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The install… |
CVE-2019-19363 | High | 7.8 | 2020-01-24 | An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected… |
CVE-2019-19895 | High | 7.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by mod… |
CVE-2019-19894 | Medium | 5.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) ca… |
CVE-2012-2087 | Critical | 9.8 | 2020-01-23 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. |
CVE-2019-14629 | Medium | 5.5 | 2020-01-17 | Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2019-3683 | High | 8.8 | 2020-01-17 | The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/us… |
CVE-2019-20327 | High | 7.8 | 2020-01-16 | Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is… |
CVE-2019-16784 | High | 7.0 | 2020-01-14 | In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstal… |
CVE-2019-19727 | Medium | 5.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. |
CVE-2019-19263 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. |
CVE-2019-19262 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. |
CVE-2019-19087 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). |
CVE-2019-19086 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). |
CVE-2019-19736 | Medium | 6.1 | 2019-12-30 | MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be u… |
CVE-2019-3467 | High | 7.8 | 2019-12-23 | Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for th… |
CVE-2019-19915 | Critical | 9.0 | 2019-12-19 | The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redi… |
CVE-2019-19341 | Medium | 5.5 | 2019-12-19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET… |
CVE-2019-8256 | Critical | 9.8 | 2019-12-19 | ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could… |
CVE-2019-19882 | High | 7.8 | 2019-12-18 | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs ar… |
CVE-2019-19315 | High | 7.1 | 2019-12-17 | NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMail… |
CVE-2019-9464 | Medium | 5.5 | 2019-12-06 | In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app… |
CVE-2019-17388 | High | 7.8 | 2019-12-05 | Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary… |
CVE-2013-0326 | Medium | 5.5 | 2019-12-05 | OpenStack nova base images permissions are world readable |
CVE-2019-19522 | High | 7.8 | 2019-12-05 | OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the… |
CVE-2019-19382 | High | 7.8 | 2019-12-03 | Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replace a .exe or .dll file to achieve privil… |
CVE-2019-5212 | Medium | 5.5 | 2019-11-29 | There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An… |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2012-6655 | Low | 3.3 | 2019-11-27 | An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords. |
CVE-2019-14812 | High | 7.8 | 2019-11-27 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-18456 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insec… |
CVE-2019-18453 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions. |
CVE-2019-18452 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecu… |
CVE-2019-18450 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions. |
CVE-2019-18449 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2). |
CVE-2019-18447 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions. |
CVE-2019-18446 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2). |
CVE-2019-18459 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of… |
CVE-2019-18463 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4). |
CVE-2019-18462 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions. |
CVE-2019-13681 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML p… |
CVE-2019-13679 | Low | 3.3 | 2019-11-25 | Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file. |
CVE-2019-13677 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML… |
CVE-2019-13676 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13665 | Medium | 6.5 | 2019-11-25 | Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML… |
CVE-2019-4214 | Low | 3.7 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obta… |
CVE-2019-19197 | High | 7.8 | 2019-11-21 | IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execu… |
CVE-2019-16406 | High | 7.8 | 2019-11-21 | Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gai… |
CVE-2019-18958 | High | 7.8 | 2019-11-21 | Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG… |
CVE-2019-14869 | High | 8.8 | 2019-11-15 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabli… |
CVE-2019-15340 | Low | 3.3 | 2019-11-14 | The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys con… |
CVE-2019-15339 | Low | 3.3 | 2019-11-14 | The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package n… |
CVE-2019-15338 | Low | 3.3 | 2019-11-14 | The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installe… |
CVE-2019-15337 | Low | 3.3 | 2019-11-14 | The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name… |
CVE-2019-15336 | Low | 3.3 | 2019-11-14 | The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0/O11019/1536917928:user/release-keys contains a pre-installed app w… |
CVE-2019-15335 | Low | 3.3 | 2019-11-14 | The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name… |
CVE-2019-15334 | Low | 3.3 | 2019-11-14 | The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0/O11019/1538188945:user/release-keys contains a pre-installed app… |
CVE-2019-15333 | Low | 3.3 | 2019-11-14 | The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package n… |
CVE-2019-11155 | High | 7.1 | 2019-11-14 | Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of s… |
CVE-2019-11154 | High | 7.1 | 2019-11-14 | Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of s… |
CVE-2012-1160 | Low | 2.7 | 2019-11-14 | Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php |
CVE-2019-18895 | High | 7.8 | 2019-11-14 | Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable… |
CVE-2019-1457 | High | 7.8 | 2019-11-12 | A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel S… |
CVE-2019-18856 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use ele… |
CVE-2019-13535 | Medium | 4.6 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-3425 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker cou… |
CVE-2019-3866 | Medium | 5.5 | 2019-11-08 | An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2007-5743 | High | 7.5 | 2019-11-07 | viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. |
CVE-2019-5642 | Low | 3.3 | 2019-11-06 | Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system duri… |
CVE-2019-5068 | Medium | 4.4 | 2019-11-05 | An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared me… |
CVE-2016-4983 | Low | 3.3 | 2019-11-05 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2013-4367 | High | 7.8 | 2019-11-01 | ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.ch… |
CVE-2011-3923 | Critical | 9.8 | 2019-11-01 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. |
CVE-2019-18422 | High | 8.8 | 2019-10-31 | An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling… |
CVE-2010-0747 | High | 7.8 | 2019-10-30 | drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725. |
CVE-2010-0737 | High | 8.0 | 2019-10-30 | A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to pe… |
CVE-2016-5202 | Critical | 9.1 | 2019-10-25 | browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux n… |
CVE-2019-18409 | High | 7.8 | 2019-10-24 | The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (whi… |
CVE-2019-18192 | High | 7.8 | 2019-10-17 | GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable… |
CVE-2019-8071 | Critical | 9.8 | 2019-10-17 | Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2019-11167 | High | 7.8 | 2019-10-11 | Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potentially enable esc… |
CVE-2019-11528 | High | 7.5 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable. |
CVE-2019-11526 | Critical | 9.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the… |
CVE-2019-1378 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbi… |
CVE-2019-3765 | High | 8.1 | 2019-10-09 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |
CVE-2019-0073 | Medium | 6.6 | 2019-10-09 | The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user… |
CVE-2019-6465 | Medium | 5.3 | 2019-10-09 | Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-… |
CVE-2015-9456 | Medium | 6.5 | 2019-10-07 | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=or… |
CVE-2019-17051 | High | 7.8 | 2019-09-30 | Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-cl… |
CVE-2019-9378 | High | 7.8 | 2019-09-27 | In the Activity Manager service, there is a possible permission bypass due to incorrect permission check. This could lead to local escalation of privilege with… |
CVE-2019-12245 | Medium | 5.3 | 2019-09-25 | SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in… |
CVE-2019-13356 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allow… |
CVE-2019-13355 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows l… |
CVE-2019-9008 | High | 8.8 | 2019-09-17 | An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime. |
CVE-2019-15721 | Medium | 5.4 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view… |