CWE-732 · Incorrect Permission Assignment for Critical Resource (page 14)
Page 14 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11166 | Medium | 6.7 | 2019-09-16 | Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable esc… |
CVE-2019-16354 | Medium | 4.7 | 2019-09-16 | The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory… |
CVE-2019-16187 | High | 7.5 | 2019-09-09 | Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script. |
CVE-2018-18630 | High | 7.8 | 2019-09-06 | A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default installation may allow an attacker with local… |
CVE-2019-12645 | High | 7.8 | 2019-09-05 | A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, lo… |
CVE-2019-12635 | Medium | 4.3 | 2019-09-05 | A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-15752 | High | 7.8 | 2019-08-28 | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMD… |
CVE-2019-15316 | High | 7.0 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of Crea… |
CVE-2019-15315 | High | 7.8 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of… |
CVE-2019-11806 | Low | 3.3 | 2019-08-20 | OX App Suite 7.10.1 and earlier has Insecure Permissions. |
CVE-2019-13069 | High | 7.8 | 2019-08-17 | extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.conf… |
CVE-2019-7958 | Critical | 9.8 | 2019-08-16 | Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privi… |
CVE-2019-15119 | Medium | 5.5 | 2019-08-16 | lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user. |
CVE-2019-15084 | High | 7.8 | 2019-08-16 | Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result, a local attacker can escalate to SYSTEM. |
CVE-2018-12357 | Medium | 6.5 | 2019-08-15 | Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions. |
CVE-2019-0341 | High | 8.8 | 2019-08-14 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application… |
CVE-2019-12808 | High | 7.8 | 2019-08-13 | ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an e… |
CVE-2019-14969 | High | 7.8 | 2019-08-12 | Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.AD… |
CVE-2019-14935 | High | 7.8 | 2019-08-12 | 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for… |
CVE-2019-1944 | High | 7.3 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-14743 | Medium | 6.6 | 2019-08-07 | In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local… |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2018-20936 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308). |
CVE-2018-20909 | High | 7.1 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). |
CVE-2018-20908 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). |
CVE-2018-20907 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432). |
CVE-2018-20906 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430). |
CVE-2018-20905 | Medium | 5.4 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). |
CVE-2018-20904 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427). |
CVE-2018-20871 | Critical | 9.8 | 2019-07-30 | In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in cer… |
CVE-2019-14395 | Low | 3.3 | 2019-07-30 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). |
CVE-2018-2024 | High | 8.1 | 2019-07-22 | IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended acto… |
CVE-2019-1010101 | Critical | 9.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component… |
CVE-2019-5222 | Medium | 5.5 | 2019-07-17 | There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The… |
CVE-2019-12876 | High | 7.3 | 2019-07-17 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low… |
CVE-2019-1010009 | Critical | 9.8 | 2019-07-15 | DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The a… |
CVE-2019-12577 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-13142 | Medium | 5.5 | 2019-07-09 | The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRA… |
CVE-2019-13208 | High | 7.3 | 2019-07-03 | WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, leading to DLL side l… |
CVE-2018-14862 | Medium | 6.5 | 2019-07-03 | Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal us… |
CVE-2018-14861 | Medium | 6.5 | 2019-07-03 | Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure… |
CVE-2018-14866 | Medium | 4.3 | 2019-07-03 | Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers… |
CVE-2018-14916 | Critical | 9.1 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. |
CVE-2018-14886 | Medium | 4.9 | 2019-06-28 | The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allo… |
CVE-2019-13012 | High | 7.5 | 2019-06-28 | The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and… |
CVE-2019-2023 | High | 7.8 | 2019-06-19 | In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app… |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2018-19446 | High | 7.8 | 2019-06-17 | A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is us… |
CVE-2019-2257 | High | 7.8 | 2019-06-14 | Wrong permissions in configuration file can lead to unauthorized permission in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2018-3702 | High | 7.8 | 2019-06-13 | Improper permissions in the installer for the ITE Tech* Consumer Infrared Driver for Windows 10 versions before 5.4.3.0 may allow an authenticated user to pote… |
CVE-2018-19860 | High | 8.8 | 2019-06-07 | Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly rest… |
CVE-2019-12777 | High | 7.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and pr… |
CVE-2019-8283 | Medium | 6.5 | 2019-06-07 | Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it. |
CVE-2018-10171 | Critical | 9.8 | 2019-06-05 | Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` comp… |
CVE-2019-12373 | Critical | 9.0 | 2019-06-03 | Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote dis… |
CVE-2019-12589 | High | 8.8 | 2019-06-03 | In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the… |
CVE-2018-20008 | Medium | 6.8 | 2019-05-28 | iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain t… |
CVE-2019-4078 | High | 7.8 | 2019-05-23 | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect… |
CVE-2019-12042 | Critical | 9.8 | 2019-05-23 | Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products befo… |
CVE-2019-10132 | High | 8.8 | 2019-05-22 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration paramet… |
CVE-2019-12102 | Critical | 9.1 | 2019-05-22 | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageorme… |
CVE-2019-12270 | High | 7.4 | 2019-05-21 | OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache fi… |
CVE-2019-0171 | High | 7.8 | 2019-05-17 | Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2019-0138 | High | 7.8 | 2019-05-17 | Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privil… |
CVE-2019-0086 | High | 7.8 | 2019-05-17 | Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Int… |
CVE-2018-3701 | High | 7.8 | 2019-05-17 | Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potent… |
CVE-2018-20500 | High | 7.5 | 2019-05-17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo… |
CVE-2018-20007 | Medium | 6.8 | 2019-05-16 | Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The att… |
CVE-2019-10116 | Medium | 4.3 | 2019-05-16 | An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10115 | Medium | 6.5 | 2019-05-16 | An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10110 | Medium | 6.5 | 2019-05-15 | An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-11328 | High | 8.8 | 2019-05-14 | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerab… |
CVE-2019-8342 | High | 7.8 | 2019-05-13 | A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set. |
CVE-2018-4028 | High | 7.5 | 2019-05-13 | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server… |
CVE-2018-12296 | High | 7.5 | 2019-05-13 | Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NA… |
CVE-2018-4073 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4072 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2019-1803 | Medium | 6.7 | 2019-05-03 | A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authe… |
CVE-2018-19374 | High | 7.0 | 2019-04-30 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin d… |
CVE-2018-14980 | High | 7.1 | 2019-04-25 | The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contai… |
CVE-2019-10710 | High | 8.8 | 2019-04-23 | Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cle… |
CVE-2019-11244 | Medium | 5.0 | 2019-04-22 | In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with wo… |
CVE-2018-18094 | High | 7.8 | 2019-04-17 | Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2019-9222 | High | 8.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2018-6269 | High | 7.8 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability in the kernel driver where input/output control (IOCTL) handling for user mode requests could create a non-trusted p… |
CVE-2018-17305 | High | 8.8 | 2019-04-11 | UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege esca… |
CVE-2018-19589 | Medium | 6.5 | 2019-04-09 | Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticate… |
CVE-2019-3893 | Medium | 4.9 | 2019-04-09 | In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password… |
CVE-2019-0804 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosur… |
CVE-2018-1787 | Medium | 5.1 | 2019-04-08 | IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872. |
CVE-2018-4324 | Medium | 5.5 | 2019-04-03 | A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macO… |
CVE-2018-4178 | Medium | 5.5 | 2019-04-03 | A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affec… |
CVE-2018-4051 | Medium | 5.5 | 2019-04-02 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2018-4049 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.48.36 (Windows 64-b… |
CVE-2018-3974 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an ex… |
CVE-2019-4093 | Medium | 4.4 | 2019-04-02 | IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interfa… |
CVE-2018-19113 | High | 7.3 | 2019-04-01 | The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for the "%PROGRAMFILES(X8… |
CVE-2018-4050 | High | 7.8 | 2019-04-01 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2019-9166 | High | 7.8 | 2019-03-28 | Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. |