CWE-732 · Incorrect Permission Assignment for Critical Resource (page 16)
Page 16 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14327 | High | 7.8 | 2018-09-26 | The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions… |
CVE-2018-8848 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to… |
CVE-2018-6040 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a… |
CVE-2018-14825 | Medium | 5.8 | 2018-09-24 | On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running… |
CVE-2018-11240 | Critical | 9.8 | 2018-09-21 | An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the c… |
CVE-2018-1711 | High | 8.4 | 2018-09-21 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modi… |
CVE-2018-11277 | High | 7.8 | 2018-09-20 | In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD… |
CVE-2018-16958 | Medium | 5.4 | 2018-09-18 | An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) w… |
CVE-2018-17037 | High | 8.8 | 2018-09-14 | user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3. |
CVE-2018-12168 | High | 7.8 | 2018-09-12 | Privilege escalation in file permissions in Intel Computing Improvement Program before version 2.2.0.03942 may allow an authenticated user to potentially execu… |
CVE-2018-12162 | High | 7.8 | 2018-09-12 | Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated user to potentially execute code using def… |
CVE-2018-12148 | High | 7.8 | 2018-09-12 | Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticated user to potentially execute code as ad… |
CVE-2018-15502 | High | 7.5 | 2018-09-12 | Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predicta… |
CVE-2018-13412 | High | 7.8 | 2018-09-12 | An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM… |
CVE-2018-13411 | High | 8.8 | 2018-09-12 | An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate… |
CVE-2018-11078 | Medium | 4.0 | 2018-09-11 | Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from… |
CVE-2018-16715 | High | 8.8 | 2018-09-08 | An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\CTES folder and sub-folders m… |
CVE-2018-16703 | Medium | 5.3 | 2018-09-07 | A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help… |
CVE-2018-1000660 | High | 7.5 | 2018-09-06 | TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vul… |
CVE-2018-16145 | High | 8.1 | 2018-09-05 | The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited… |
CVE-2018-15681 | Critical | 9.8 | 2018-09-05 | An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie… |
CVE-2018-16545 | High | 7.8 | 2018-09-05 | Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve arbitrary code execution via file impers… |
CVE-2018-6598 | High | 7.1 | 2018-08-29 | An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent… |
CVE-2018-15869 | Medium | 5.3 | 2018-08-25 | An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source… |
CVE-2018-15809 | Medium | 5.5 | 2018-08-23 | AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. This may allow local attackers t… |
CVE-2018-1000226 | Critical | 9.8 | 2018-08-20 | Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable… |
CVE-2018-1000649 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that c… |
CVE-2018-15491 | High | 7.5 | 2018-08-18 | A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take contr… |
CVE-2018-15482 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006. |
CVE-2018-14982 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. |
CVE-2018-14981 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. |
CVE-2018-5546 | High | 7.8 | 2018-08-17 | The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unp… |
CVE-2018-11454 | High | 8.6 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-11453 | High | 7.8 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-1551 | Low | 3.1 | 2018-08-06 | IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator crea… |
CVE-2018-5490 | High | 8.8 | 2018-08-03 | Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than "read-only" a… |
CVE-2018-12467 | Medium | 6.0 | 2018-08-01 | Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage… |
CVE-2018-12466 | Medium | 4.4 | 2018-08-01 | openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. |
CVE-2016-8637 | Medium | 5.0 | 2018-08-01 | A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used… |
CVE-2017-2590 | High | 8.1 | 2018-07-27 | A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs… |
CVE-2017-12167 | Medium | 5.5 | 2018-07-26 | It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are… |
CVE-2018-10869 | High | 7.5 | 2018-07-19 | redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by th… |
CVE-2018-5540 | Medium | 4.4 | 2018-07-19 | On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Clo… |
CVE-2018-0392 | Medium | 5.5 | 2018-07-18 | A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due t… |
CVE-2018-1000211 | High | 7.5 | 2018-07-13 | Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access toke… |
CVE-2018-1000209 | High | 8.8 | 2018-07-13 | Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Windows platforms that can result in Unpri… |
CVE-2018-1000207 | High | 7.2 | 2018-07-13 | MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can… |
CVE-2018-14043 | Critical | 9.8 | 2018-07-13 | mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to delete an existing fil… |
CVE-2018-12979 | Medium | 6.5 | 2018-07-12 | An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwri… |
CVE-2016-9604 | Medium | 4.4 | 2018-07-11 | It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_t… |
CVE-2018-13791 | Critical | 9.8 | 2018-07-09 | The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12/Login/Server/SevaU… |
CVE-2018-1000621 | High | 8.1 | 2018-07-09 | Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execut… |
CVE-2017-7471 | Critical | 9.0 | 2018-07-09 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. I… |
CVE-2018-11259 | High | 7.7 | 2018-07-06 | Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS… |
CVE-2018-13110 | High | 7.5 | 2018-07-06 | All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerability where attackers can gain access to th… |
CVE-2018-13122 | Medium | 6.5 | 2018-07-03 | onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) screen, as demonstrated by a ?i=var/www/… |
CVE-2017-0913 | Medium | 4.7 | 2018-07-03 | Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system… |
CVE-2018-11642 | High | 7.8 | 2018-07-03 | Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to exec… |
CVE-2018-1113 | Medium | 4.8 | 2018-07-03 | setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assu… |
CVE-2018-10856 | Medium | 5.3 | 2018-07-03 | It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary p… |
CVE-2018-10843 | High | 8.5 | 2018-07-02 | source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalat… |
CVE-2018-13025 | Medium | 4.9 | 2018-06-29 | protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic pic… |
CVE-2018-12922 | High | 7.5 | 2018-06-28 | Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI. |
CVE-2018-1354 | Medium | 6.5 | 2018-06-27 | An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regul… |
CVE-2018-11053 | Medium | 6.5 | 2018-06-26 | Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission… |
CVE-2018-1000547 | Medium | 5.3 | 2018-06-26 | coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records… |
CVE-2018-1000511 | High | 7.5 | 2018-06-26 | WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. Th… |
CVE-2018-1000510 | Medium | 6.5 | 2018-06-26 | WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. Thi… |
CVE-2018-12642 | High | 7.5 | 2018-06-22 | Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. |
CVE-2018-12615 | Medium | 5.3 | 2018-06-21 | An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correc… |
CVE-2018-11116 | High | 8.8 | 2018-06-19 | OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i… |
CVE-2018-12028 | High | 7.8 | 2018-06-17 | An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawnin… |
CVE-2018-12027 | High | 8.8 | 2018-06-17 | An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a… |
CVE-2018-12335 | High | 7.3 | 2018-06-17 | Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys, and access and manipulate securi… |
CVE-2018-12457 | High | 8.8 | 2018-06-15 | expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header. |
CVE-2018-1036 | High | 7.0 | 2018-06-14 | An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Win… |
CVE-2018-0982 | High | 7.0 | 2018-06-14 | An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."… |
CVE-2018-12259 | Medium | 6.8 | 2018-06-12 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system com… |
CVE-2017-7821 | Critical | 9.8 | 2018-06-11 | A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user inte… |
CVE-2017-5456 | Critical | 9.8 | 2018-06-11 | A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and… |
CVE-2017-5426 | Medium | 5.3 | 2018-06-11 | On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and… |
CVE-2018-4251 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Firmware" component. It allows attackers to modify… |
CVE-2018-4238 | Low | 2.4 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2018-4220 | High | 8.8 | 2018-06-08 | An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is affected. The issue involves the "Swift for Ubuntu" component… |
CVE-2012-0433 | Low | 3.3 | 2018-06-08 | The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local… |
CVE-2018-0352 | Medium | 6.7 | 2018-06-07 | A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to… |
CVE-2017-18285 | High | 7.1 | 2018-06-04 | The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and wri… |
CVE-2017-18284 | High | 7.1 | 2018-06-04 | The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitr… |
CVE-2018-11194 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6). |
CVE-2018-11193 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6). |
CVE-2018-11192 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6). |
CVE-2018-11191 | High | 8.8 | 2018-06-02 | Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6). |
CVE-2018-1370 | Medium | 4.2 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read o… |
CVE-2018-11334 | High | 7.8 | 2018-05-23 | Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\.\pipe\WindscribeService. |
CVE-2017-2612 | Medium | 5.4 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly… |
CVE-2018-1115 | Critical | 9.1 | 2018-05-10 | postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than… |
CVE-2017-4952 | High | 7.5 | 2018-05-02 | VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass… |
CVE-2018-5516 | Medium | 4.7 | 2018-05-02 | On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and… |
CVE-2018-10647 | High | 7.8 | 2018-05-02 | SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service" service executes… |
CVE-2018-10646 | High | 7.8 | 2018-05-02 | CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. This service establishes a NetName… |