CWE-732 · Incorrect Permission Assignment for Critical Resource (page 15)
Page 15 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15835 | High | 7.5 | 2018-11-30 | Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983. |
CVE-2018-15768 | Medium | 6.5 | 2018-11-30 | Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due to insecure default configuration sett… |
CVE-2018-11002 | Medium | 5.5 | 2018-11-29 | Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions. |
CVE-2018-13355 | Medium | 6.5 | 2018-11-27 | Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization. |
CVE-2018-11914 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11913 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nodes may lead to pote… |
CVE-2018-11910 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11909 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11908 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11907 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-13321 | High | 8.8 | 2018-11-26 | Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter. |
CVE-2018-18561 | High | 8.0 | 2018-11-20 | An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. I… |
CVE-2018-14934 | Medium | 6.5 | 2018-11-15 | The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and sub… |
CVE-2018-6057 | High | 8.8 | 2018-11-14 | Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass i… |
CVE-2018-3697 | High | 7.8 | 2018-11-14 | Improper directory permissions in the installer for the Intel Media Server Studio may allow unprivileged users to potentially enable an escalation of privilege… |
CVE-2018-2490 | High | 7.8 | 2018-11-13 | The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issu… |
CVE-2018-2489 | High | 7.8 | 2018-11-13 | Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Go… |
CVE-2018-19072 | Medium | 5.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19071 | High | 7.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2016-2121 | Medium | 4.0 | 2018-10-31 | A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A loc… |
CVE-2018-10712 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-10710 | High | 7.1 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-10709 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-11951 | Medium | 5.5 | 2018-10-26 | Improper access control in core module lead XBL_LOADER performs the ZI region clear for QTEE instead of XBL_SEC in Snapdragon Mobile in version SD 845, SD 850. |
CVE-2018-18654 | High | 7.8 | 2018-10-26 | Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdirectory in a certain… |
CVE-2018-11792 | Critical | 9.8 | 2018-10-24 | In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a tabl… |
CVE-2018-17873 | High | 8.8 | 2018-10-23 | An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows an attacker with adj… |
CVE-2017-18348 | High | 7.0 | 2018-10-19 | Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging… |
CVE-2018-11080 | High | 7.3 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configurati… |
CVE-2018-7924 | Low | 2.4 | 2018-10-17 | Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific comm… |
CVE-2018-13399 | High | 7.8 | 2018-10-16 | The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissio… |
CVE-2018-17892 | High | 8.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utili… |
CVE-2018-1724 | Medium | 5.9 | 2018-10-11 | IBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to change their job user at job submission time due to improper file permission settings… |
CVE-2018-12173 | High | 7.6 | 2018-10-10 | Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an… |
CVE-2018-12131 | High | 7.8 | 2018-10-10 | Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to… |
CVE-2018-8411 | High | 7.8 | 2018-10-10 | An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Win… |
CVE-2018-17775 | High | 7.8 | 2018-10-08 | Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an… |
CVE-2018-1750 | Medium | 4.2 | 2018-10-08 | IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unin… |
CVE-2018-11064 | High | 7.8 | 2018-10-05 | Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally aut… |
CVE-2018-15379 | Critical | 9.8 | 2018-10-05 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote… |
CVE-2018-0422 | High | 7.3 | 2018-10-05 | A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored file… |
CVE-2018-17872 | High | 8.8 | 2018-10-04 | Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions. |
CVE-2018-6261 | High | 7.0 | 2018-10-02 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, which may to code execu… |
CVE-2018-1420 | Medium | 5.3 | 2018-10-01 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation… |
CVE-2018-17776 | High | 7.8 | 2018-09-28 | PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users to gain privileges by replacing an exec… |
CVE-2018-14650 | Medium | 5.9 | 2018-09-27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any… |
CVE-2018-16588 | High | 7.8 | 2018-09-26 | Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise… |
CVE-2018-14327 | High | 7.8 | 2018-09-26 | The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions… |
CVE-2018-8848 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to… |
CVE-2018-6040 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a… |
CVE-2018-14825 | Medium | 5.8 | 2018-09-24 | On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running… |
CVE-2018-11240 | Critical | 9.8 | 2018-09-21 | An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the c… |
CVE-2018-1711 | High | 8.4 | 2018-09-21 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modi… |
CVE-2018-11277 | High | 7.8 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD… |
CVE-2018-16958 | Medium | 5.4 | 2018-09-18 | An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) w… |
CVE-2018-17037 | High | 8.8 | 2018-09-14 | user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. |
CVE-2018-12168 | High | 7.8 | 2018-09-12 | Privilege escalation in file permissions in Intel Computing Improvement Program before version 2.2.0.03942 may allow an authenticated user to potentially execu… |
CVE-2018-12162 | High | 7.8 | 2018-09-12 | Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated user to potentially execute code using def… |
CVE-2018-12148 | High | 7.8 | 2018-09-12 | Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticated user to potentially execute code as ad… |
CVE-2018-15502 | High | 7.5 | 2018-09-12 | Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predicta… |
CVE-2018-13412 | High | 7.8 | 2018-09-12 | An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM… |
CVE-2018-13411 | High | 8.8 | 2018-09-12 | An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate… |
CVE-2018-11078 | Medium | 4.0 | 2018-09-11 | Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from… |
CVE-2018-16715 | High | 8.8 | 2018-09-08 | An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders m… |
CVE-2018-16703 | Medium | 5.3 | 2018-09-07 | A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help… |
CVE-2018-1000660 | High | 7.5 | 2018-09-06 | TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vul… |
CVE-2018-16145 | High | 8.1 | 2018-09-05 | The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited… |
CVE-2018-15681 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie… |
CVE-2018-16545 | High | 7.8 | 2018-09-05 | Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execution via file impers… |
CVE-2018-6598 | High | 7.1 | 2018-08-29 | An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent… |
CVE-2018-15869 | Medium | 5.3 | 2018-08-25 | An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source… |
CVE-2018-15809 | Medium | 5.5 | 2018-08-23 | AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. This may allow local attackers t… |
CVE-2018-1000226 | Critical | 9.8 | 2018-08-20 | Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable… |
CVE-2018-1000649 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that c… |
CVE-2018-15491 | High | 7.5 | 2018-08-18 | A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take contr… |
CVE-2018-15482 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006. |
CVE-2018-14982 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. |
CVE-2018-14981 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. |
CVE-2018-5546 | High | 7.8 | 2018-08-17 | The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unp… |
CVE-2018-11454 | High | 8.6 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-11453 | High | 7.8 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-1551 | Low | 3.1 | 2018-08-06 | IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator crea… |
CVE-2018-5490 | High | 8.8 | 2018-08-03 | Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than "read-only" a… |
CVE-2018-12467 | Medium | 6.0 | 2018-08-01 | Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage… |
CVE-2018-12466 | Medium | 4.4 | 2018-08-01 | openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. |
CVE-2016-8637 | Medium | 5.0 | 2018-08-01 | A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used… |
CVE-2017-2590 | High | 8.1 | 2018-07-27 | A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs… |
CVE-2017-12167 | Medium | 5.5 | 2018-07-26 | It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are… |
CVE-2018-10869 | High | 7.5 | 2018-07-19 | redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by th… |
CVE-2018-5540 | Medium | 4.4 | 2018-07-19 | On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Clo… |
CVE-2018-0392 | Medium | 5.5 | 2018-07-18 | A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due t… |
CVE-2018-1000211 | High | 7.5 | 2018-07-13 | Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access toke… |
CVE-2018-1000209 | High | 8.8 | 2018-07-13 | Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Windows platforms that can result in Unpri… |
CVE-2018-1000207 | High | 7.2 | 2018-07-13 | MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can… |
CVE-2018-14043 | Critical | 9.8 | 2018-07-13 | mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to delete an existing fil… |
CVE-2018-12979 | Medium | 6.5 | 2018-07-12 | An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwri… |
CVE-2016-9604 | Medium | 4.4 | 2018-07-11 | It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_t… |
CVE-2018-13791 | Critical | 9.8 | 2018-07-09 | The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12/Login/Server/SevaU… |
CVE-2018-1000621 | High | 8.1 | 2018-07-09 | Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execut… |
CVE-2017-7471 | Critical | 9.0 | 2018-07-09 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. I… |