CWE-732 · Incorrect Permission Assignment for Critical Resource (page 15)
Page 15 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9626 | Critical | 9.8 | 2019-03-27 | Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This up… |
CVE-2018-12546 | Medium | 6.5 | 2019-03-27 | In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the ret… |
CVE-2018-18435 | High | 7.8 | 2019-03-21 | KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" t… |
CVE-2018-15508 | High | 7.5 | 2019-03-21 | Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connection on port 8083 to… |
CVE-2018-15509 | Critical | 9.8 | 2019-03-18 | Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2). |
CVE-2018-19393 | High | 7.5 | 2019-03-15 | Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was e… |
CVE-2018-18254 | High | 7.8 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the cal_whitelist table in the Custom App Launcher (CAL) database, a… |
CVE-2018-12223 | Medium | 6.3 | 2019-03-14 | Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15… |
CVE-2018-12217 | Low | 2.3 | 2019-03-14 | Insufficient access control in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 1… |
CVE-2018-12209 | Low | 3.3 | 2019-03-14 | Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15… |
CVE-2018-12200 | Medium | 6.7 | 2019-03-14 | Insufficient access control in Intel(R) Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privilege… |
CVE-2018-20621 | High | 7.8 | 2019-03-13 | An issue was discovered in Microvirt MEmu 6.0.6. The MemuService.exe service binary is vulnerable to local privilege escalation through binary planting due to… |
CVE-2019-1618 | High | 7.8 | 2019-03-11 | A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to… |
CVE-2019-1601 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical… |
CVE-2019-1600 | Medium | 4.4 | 2019-03-07 | A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive… |
CVE-2019-1596 | High | 7.8 | 2019-03-07 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to roo… |
CVE-2018-20798 | High | 7.5 | 2019-03-01 | The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which migh… |
CVE-2018-18495 | Medium | 6.5 | 2019-02-28 | WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an… |
CVE-2018-12396 | Medium | 6.5 | 2019-02-28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege e… |
CVE-2019-2001 | Medium | 5.5 | 2019-02-28 | The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional execution privileges needed. User intera… |
CVE-2019-7729 | Low | 3.3 | 2019-02-22 | An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succe… |
CVE-2018-9867 | Medium | 5.5 | 2019-02-19 | In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Admin… |
CVE-2019-0111 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosur… |
CVE-2019-0108 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of informa… |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2018-13374 | Medium | 4.3 | 2019-01-22 | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server… |
CVE-2018-18812 | Medium | 6.5 | 2019-01-16 | The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerabili… |
CVE-2018-14662 | Medium | 5.7 | 2019-01-15 | It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryp… |
CVE-2018-5413 | High | 8.8 | 2019-01-10 | Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation. |
CVE-2018-3703 | High | 7.8 | 2019-01-10 | Improper directory permissions in the installer for the Intel(R) SSD Data Center Tool for Windows before v3.0.17 may allow authenticated users to potentially e… |
CVE-2018-18098 | High | 7.3 | 2019-01-10 | Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via lo… |
CVE-2018-12177 | High | 7.8 | 2019-01-10 | Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90.0.7 may allow an authorized user to pot… |
CVE-2018-0449 | Medium | 4.2 | 2019-01-10 | A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local… |
CVE-2018-16087 | Medium | 4.3 | 2019-01-09 | Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2019-0588 | Medium | 6.5 | 2019-01-08 | An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka… |
CVE-2018-20131 | High | 7.8 | 2019-01-03 | The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory… |
CVE-2018-14987 | High | 7.1 | 2018-12-28 | The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201_N/m201_N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a pa… |
CVE-2018-20567 | Medium | 5.3 | 2018-12-28 | An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock ca… |
CVE-2018-20420 | Medium | 4.9 | 2018-12-24 | In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creat… |
CVE-2018-18332 | High | 7.5 | 2018-12-21 | A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other f… |
CVE-2018-18331 | High | 7.5 | 2018-12-21 | A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which c… |
CVE-2018-11964 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in /etc/passwd may lead… |
CVE-2018-6978 | Medium | 6.7 | 2018-12-18 | vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege escalation vulnerabilit… |
CVE-2018-3705 | Medium | 5.5 | 2018-12-14 | Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to potentially enable a de… |
CVE-2018-3704 | High | 7.8 | 2018-12-14 | Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalatio… |
CVE-2018-18097 | High | 7.8 | 2018-12-14 | Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2018-18093 | High | 7.8 | 2018-12-14 | Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access… |
CVE-2018-20145 | High | 7.5 | 2018-12-13 | Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the defau… |
CVE-2018-18352 | Medium | 6.5 | 2018-12-11 | Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same… |
CVE-2018-18349 | Medium | 6.5 | 2018-12-11 | Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user… |
CVE-2018-6755 | High | 7.2 | 2018-12-06 | Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code… |
CVE-2018-14703 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the M… |
CVE-2018-19836 | Medium | 6.1 | 2018-12-03 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering var… |
CVE-2018-15835 | High | 7.5 | 2018-11-30 | Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983. |
CVE-2018-15768 | Medium | 6.5 | 2018-11-30 | Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due to insecure default configuration sett… |
CVE-2018-11002 | Medium | 5.5 | 2018-11-29 | Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions. |
CVE-2018-13355 | Medium | 6.5 | 2018-11-27 | Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization. |
CVE-2018-11914 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11913 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nodes may lead to pote… |
CVE-2018-11910 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11909 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11908 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-11907 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and… |
CVE-2018-13321 | High | 8.8 | 2018-11-26 | Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter. |
CVE-2018-18561 | High | 8.0 | 2018-11-20 | An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. I… |
CVE-2018-14934 | Medium | 6.5 | 2018-11-15 | The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and sub… |
CVE-2018-6057 | High | 8.8 | 2018-11-14 | Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass i… |
CVE-2018-3697 | High | 7.8 | 2018-11-14 | Improper directory permissions in the installer for the Intel Media Server Studio may allow unprivileged users to potentially enable an escalation of privilege… |
CVE-2018-2490 | High | 7.8 | 2018-11-13 | The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issu… |
CVE-2018-2489 | High | 7.8 | 2018-11-13 | Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Go… |
CVE-2018-19072 | Medium | 5.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19071 | High | 7.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2016-2121 | Medium | 4.0 | 2018-10-31 | A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A loc… |
CVE-2018-10712 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-10710 | High | 7.1 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-10709 | High | 7.8 | 2018-10-30 | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI… |
CVE-2018-11951 | Medium | 5.5 | 2018-10-26 | Improper access control in core module lead XBL_LOADER performs the ZI region clear for QTEE instead of XBL_SEC in Snapdragon Mobile in version SD 845, SD 850. |
CVE-2018-18654 | High | 7.8 | 2018-10-26 | Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdirectory in a certain… |
CVE-2018-11792 | Critical | 9.8 | 2018-10-24 | In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a tabl… |
CVE-2018-17873 | High | 8.8 | 2018-10-23 | An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows an attacker with adj… |
CVE-2017-18348 | High | 7.0 | 2018-10-19 | Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging… |
CVE-2018-11080 | High | 7.3 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configurati… |
CVE-2018-7924 | Low | 2.4 | 2018-10-17 | Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific comm… |
CVE-2018-13399 | High | 7.8 | 2018-10-16 | The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissio… |
CVE-2018-17892 | High | 8.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utili… |
CVE-2018-1724 | Medium | 5.9 | 2018-10-11 | IBM Spectrum LSF 9.1.1 9.1.2, 9.1.3, and 10.1 could allow a local user to change their job user at job submission time due to improper file permission settings… |
CVE-2018-12173 | High | 7.6 | 2018-10-10 | Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an… |
CVE-2018-12131 | High | 7.8 | 2018-10-10 | Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to… |
CVE-2018-8411 | High | 7.8 | 2018-10-10 | An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Win… |
CVE-2018-17775 | High | 7.8 | 2018-10-08 | Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an… |
CVE-2018-1750 | Medium | 4.2 | 2018-10-08 | IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unin… |
CVE-2018-11064 | High | 7.8 | 2018-10-05 | Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally aut… |
CVE-2018-15379 | Critical | 9.8 | 2018-10-05 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote… |
CVE-2018-0422 | High | 7.3 | 2018-10-05 | A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored file… |
CVE-2018-17872 | High | 8.8 | 2018-10-04 | Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions. |
CVE-2018-6261 | High | 7.0 | 2018-10-02 | NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, which may to code execu… |
CVE-2018-1420 | Medium | 5.3 | 2018-10-01 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation… |
CVE-2018-17776 | High | 7.8 | 2018-09-28 | PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users to gain privileges by replacing an exec… |
CVE-2018-14650 | Medium | 5.9 | 2018-09-27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any… |
CVE-2018-16588 | High | 7.8 | 2018-09-26 | Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise… |