CWE-732 · Incorrect Permission Assignment for Critical Resource (page 14)
Page 14 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8283 | Medium | 6.5 | 2019-06-07 | Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it. |
CVE-2018-10171 | Critical | 9.8 | 2019-06-05 | Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` comp… |
CVE-2019-12373 | Critical | 9.0 | 2019-06-03 | Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote dis… |
CVE-2019-12589 | High | 8.8 | 2019-06-03 | In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the… |
CVE-2018-20008 | Medium | 6.8 | 2019-05-28 | iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain t… |
CVE-2019-4078 | High | 7.8 | 2019-05-23 | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect… |
CVE-2019-12042 | Critical | 9.8 | 2019-05-23 | Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products befo… |
CVE-2019-10132 | High | 8.8 | 2019-05-22 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration paramet… |
CVE-2019-12102 | Critical | 9.1 | 2019-05-22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageorme… |
CVE-2019-12270 | High | 7.4 | 2019-05-21 | OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache fi… |
CVE-2019-0171 | High | 7.8 | 2019-05-17 | Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2019-0138 | High | 7.8 | 2019-05-17 | Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privil… |
CVE-2019-0086 | High | 7.8 | 2019-05-17 | Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Int… |
CVE-2018-3701 | High | 7.8 | 2019-05-17 | Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potent… |
CVE-2018-20500 | High | 7.5 | 2019-05-17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo… |
CVE-2018-20007 | Medium | 6.8 | 2019-05-16 | Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The att… |
CVE-2019-10116 | Medium | 4.3 | 2019-05-16 | An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10115 | Medium | 6.5 | 2019-05-16 | An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10110 | Medium | 6.5 | 2019-05-15 | An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-11328 | High | 8.8 | 2019-05-14 | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerab… |
CVE-2019-8342 | High | 7.8 | 2019-05-13 | A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set. |
CVE-2018-4028 | High | 7.5 | 2019-05-13 | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server… |
CVE-2018-12296 | High | 7.5 | 2019-05-13 | Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NA… |
CVE-2018-4073 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4072 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2019-1803 | Medium | 6.7 | 2019-05-03 | A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authe… |
CVE-2018-19374 | High | 7.0 | 2019-04-30 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin d… |
CVE-2018-14980 | High | 7.1 | 2019-04-25 | The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contai… |
CVE-2019-10710 | High | 8.8 | 2019-04-23 | Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cle… |
CVE-2019-11244 | Medium | 5.0 | 2019-04-22 | In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with wo… |
CVE-2018-18094 | High | 7.8 | 2019-04-17 | Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2019-9222 | High | 8.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2018-6269 | High | 7.8 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability in the kernel driver where input/output control (IOCTL) handling for user mode requests could create a non-trusted p… |
CVE-2018-17305 | High | 8.8 | 2019-04-11 | UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege esca… |
CVE-2018-19589 | Medium | 6.5 | 2019-04-09 | Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticate… |
CVE-2019-3893 | Medium | 4.9 | 2019-04-09 | In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password… |
CVE-2019-0804 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosur… |
CVE-2018-1787 | Medium | 5.1 | 2019-04-08 | IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872. |
CVE-2018-4324 | Medium | 5.5 | 2019-04-03 | A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macO… |
CVE-2018-4178 | Medium | 5.5 | 2019-04-03 | A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affec… |
CVE-2018-4051 | Medium | 5.5 | 2019-04-02 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2018-4049 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.48.36 (Windows 64-b… |
CVE-2018-3974 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an ex… |
CVE-2019-4093 | Medium | 4.4 | 2019-04-02 | IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interfa… |
CVE-2018-19113 | High | 7.3 | 2019-04-01 | The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for the "%PROGRAMFILES(X8… |
CVE-2018-4050 | High | 7.8 | 2019-04-01 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2019-9166 | High | 7.8 | 2019-03-28 | Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. |
CVE-2017-9626 | Critical | 9.8 | 2019-03-27 | Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This up… |
CVE-2018-12546 | Medium | 6.5 | 2019-03-27 | In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the ret… |
CVE-2018-18435 | High | 7.8 | 2019-03-21 | KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" t… |
CVE-2018-15508 | High | 7.5 | 2019-03-21 | Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connection on port 8083 to… |
CVE-2018-15509 | Critical | 9.8 | 2019-03-18 | Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2). |
CVE-2018-19393 | High | 7.5 | 2019-03-15 | Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was e… |
CVE-2018-18254 | High | 7.8 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the cal_whitelist table in the Custom App Launcher (CAL) database, a… |
CVE-2018-12223 | Medium | 6.3 | 2019-03-14 | Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15… |
CVE-2018-12217 | Low | 2.3 | 2019-03-14 | Insufficient access control in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 1… |
CVE-2018-12209 | Low | 3.3 | 2019-03-14 | Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15… |
CVE-2018-12200 | Medium | 6.7 | 2019-03-14 | Insufficient access control in Intel(R) Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privilege… |
CVE-2018-20621 | High | 7.8 | 2019-03-13 | An issue was discovered in Microvirt MEmu 6.0.6. The MemuService.exe service binary is vulnerable to local privilege escalation through binary planting due to… |
CVE-2019-1618 | High | 7.8 | 2019-03-11 | A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to… |
CVE-2019-1601 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical… |
CVE-2019-1600 | Medium | 4.4 | 2019-03-07 | A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive… |
CVE-2019-1596 | High | 7.8 | 2019-03-07 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to roo… |
CVE-2018-20798 | High | 7.5 | 2019-03-01 | The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which migh… |
CVE-2018-18495 | Medium | 6.5 | 2019-02-28 | WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an… |
CVE-2018-12396 | Medium | 6.5 | 2019-02-28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege e… |
CVE-2019-2001 | Medium | 5.5 | 2019-02-28 | The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional execution privileges needed. User intera… |
CVE-2019-7729 | Low | 3.3 | 2019-02-22 | An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succe… |
CVE-2018-9867 | Medium | 5.5 | 2019-02-19 | In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Admin… |
CVE-2019-0111 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosur… |
CVE-2019-0108 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of informa… |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2018-13374 | Medium | 4.3 | 2019-01-22 | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server… |
CVE-2018-18812 | Medium | 6.5 | 2019-01-16 | The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerabili… |
CVE-2018-14662 | Medium | 5.7 | 2019-01-15 | It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryp… |
CVE-2018-5413 | High | 8.8 | 2019-01-10 | Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation. |
CVE-2018-3703 | High | 7.8 | 2019-01-10 | Improper directory permissions in the installer for the Intel(R) SSD Data Center Tool for Windows before v3.0.17 may allow authenticated users to potentially e… |
CVE-2018-18098 | High | 7.3 | 2019-01-10 | Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via lo… |
CVE-2018-12177 | High | 7.8 | 2019-01-10 | Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90.0.7 may allow an authorized user to pot… |
CVE-2018-0449 | Medium | 4.2 | 2019-01-10 | A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local… |
CVE-2018-16087 | Medium | 4.3 | 2019-01-09 | Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2019-0588 | Medium | 6.5 | 2019-01-08 | An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka… |
CVE-2018-20131 | High | 7.8 | 2019-01-03 | The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory… |
CVE-2018-14987 | High | 7.1 | 2018-12-28 | The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a pa… |
CVE-2018-20567 | Medium | 5.3 | 2018-12-28 | An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock ca… |
CVE-2018-20420 | Medium | 4.9 | 2018-12-24 | In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creat… |
CVE-2018-18332 | High | 7.5 | 2018-12-21 | A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other f… |
CVE-2018-18331 | High | 7.5 | 2018-12-21 | A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which c… |
CVE-2018-11964 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in /etc/passwd may lead… |
CVE-2018-6978 | Medium | 6.7 | 2018-12-18 | vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege escalation vulnerabilit… |
CVE-2018-3705 | Medium | 5.5 | 2018-12-14 | Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to potentially enable a de… |
CVE-2018-3704 | High | 7.8 | 2018-12-14 | Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalatio… |
CVE-2018-18097 | High | 7.8 | 2018-12-14 | Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2018-18093 | High | 7.8 | 2018-12-14 | Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access… |
CVE-2018-20145 | High | 7.5 | 2018-12-13 | Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the defau… |
CVE-2018-18352 | Medium | 6.5 | 2018-12-11 | Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same… |
CVE-2018-18349 | Medium | 6.5 | 2018-12-11 | Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user… |
CVE-2018-6755 | High | 7.2 | 2018-12-06 | Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code… |
CVE-2018-14703 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the M… |
CVE-2018-19836 | Medium | 6.1 | 2018-12-03 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering var… |