CWE-732 · Incorrect Permission Assignment for Critical Resource (page 18)
Page 18 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0752 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2… |
CVE-2017-12713 | High | 7.8 | 2017-08-30 | An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folder… |
CVE-2017-12816 | Critical | 9.8 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware applica… |
CVE-2017-11653 | High | 7.8 | 2017-08-18 | Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) Raze… |
CVE-2017-11652 | High | 8.4 | 2017-08-18 | Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse db… |
CVE-2017-8665 | High | 7.8 | 2017-08-15 | The Xamarin.iOS update component on systems running macOS allows an attacker to run arbitrary code as root, aka "Xamarin.iOS Elevation Of Privilege Vulnerabili… |
CVE-2017-11156 | High | 7.8 | 2017-08-14 | Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authe… |
CVE-2017-11437 | Medium | 6.5 | 2017-08-02 | GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirr… |
CVE-2017-9494 | Medium | 5.3 | 2017-07-31 | The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to enable a Remote Web Inspector that is… |
CVE-2017-9482 | Critical | 9.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to obtain root access to th… |
CVE-2017-9479 | Critical | 9.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to execute arbitrary comman… |
CVE-2017-11422 | High | 8.8 | 2017-07-24 | Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include r… |
CVE-2017-1000022 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. |
CVE-2017-0703 | High | 7.8 | 2017-07-06 | A elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-… |
CVE-2017-9615 | Critical | 9.8 | 2017-06-26 | Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes th… |
CVE-2017-9780 | High | 7.8 | 2017-06-21 | In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or wor… |
CVE-2017-8450 | High | 7.5 | 2017-06-16 | X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field… |
CVE-2017-8449 | Medium | 5.9 | 2017-06-16 | X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules… |
CVE-2017-9602 | Critical | 9.8 | 2017-06-16 | KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated u… |
CVE-2017-9606 | High | 7.3 | 2017-06-15 | Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folde… |
CVE-2017-7563 | High | 8.1 | 2017-06-07 | In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This… |
CVE-2017-9462 | High | 8.8 | 2017-06-06 | In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by usin… |
CVE-2017-7337 | Critical | 9.1 | 2017-05-27 | An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate o… |
CVE-2017-9136 | High | 7.5 | 2017-05-21 | An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET… |
CVE-2017-9079 | Medium | 4.7 | 2017-05-19 | Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occ… |
CVE-2017-7493 | High | 7.8 | 2017-05-17 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It… |
CVE-2017-0601 | Medium | 5.5 | 2017-05-12 | An Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious application to accept harmful files shared via bluetooth withou… |
CVE-2017-0593 | High | 7.8 | 2017-05-12 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissions. This issue is… |
CVE-2017-8858 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process. |
CVE-2017-8857 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using t… |
CVE-2017-8856 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' pro… |
CVE-2017-0352 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU con… |
CVE-2017-8391 | Medium | 5.5 | 2017-05-06 | The OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1 places an encrypted password into a readable local file during ope… |
CVE-2017-2115 | Medium | 4.3 | 2017-04-28 | Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors. |
CVE-2017-7850 | High | 7.8 | 2017-04-19 | Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode. |
CVE-2017-7849 | Medium | 5.5 | 2017-04-19 | Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode. |
CVE-2017-7889 | High | 7.8 | 2017-04-17 | The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or w… |
CVE-2017-3006 | High | 8.8 | 2017-04-12 | Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative Cloud de… |
CVE-2017-0884 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in… |
CVE-2017-0883 | Medium | 6.4 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing… |
CVE-2017-6338 | Medium | 6.5 | 2017-04-05 | Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, remote user with low… |
CVE-2017-7307 | Medium | 6.8 | 2017-04-04 | Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attackers to obtain root… |
CVE-2017-5199 | High | 8.8 | 2017-03-24 | The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scr… |
CVE-2017-6950 | Critical | 9.8 | 2017-03-23 | SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABAP code, aka SAP Sec… |
CVE-2017-7199 | High | 7.8 | 2017-03-23 | Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Ag… |
CVE-2017-6356 | Medium | 5.3 | 2017-03-20 | Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which allows attackers to o… |
CVE-2017-2290 | High | 8.8 | 2017-03-03 | On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with a… |
CVE-2017-6104 | High | 7.5 | 2017-03-02 | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. |
CVE-2017-0317 | High | 7.5 | 2017-02-15 | All versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it fails to set proper permissions on the package extraction path thu… |
CVE-2017-0311 | High | 8.8 | 2017-02-15 | NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possibl… |
CVE-2017-0423 | Medium | 5.3 | 2017-02-08 | An elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage access to documents on the device. This issue is rated as Mode… |
CVE-2013-0887 | | 2013-02-23 | The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileg… | |
CVE-2013-0885 | | 2013-02-23 | Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with… | |
CVE-2011-4339 | | 2011-12-15 | ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and… | |
CVE-2010-2116 | | 2010-05-28 | The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to m… | |
CVE-2010-0488 | Medium | 6.5 | 2010-03-31 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same… |
CVE-2009-3897 | Medium | 5.5 | 2009-11-24 | Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user… |
CVE-2009-3939 | High | 7.1 | 2009-11-16 | The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change t… |
CVE-2009-3611 | High | 7.1 | 2009-10-26 | common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allo… |
CVE-2009-2948 | | 2009-10-07 | mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enfo… | |
CVE-2009-3489 | High | 7.8 | 2009-09-30 | Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the s… |
CVE-2009-3482 | High | 7.8 | 2009-09-30 | TrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGRAMFILES%, which all… |
CVE-2009-3289 | High | 7.8 | 2009-09-22 | The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users… |
CVE-2009-1073 | Medium | 5.5 | 2009-03-31 | nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP s… |
CVE-2009-0115 | High | 7.8 | 2009-03-30 | The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fe… |
CVE-2009-0141 | Medium | 5.5 | 2009-02-13 | XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with luit, creates tty devices with insecure world-writable permissions, which allows local users to writ… |
CVE-2008-4870 | | 2008-11-01 | dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain t… | |
CVE-2008-3789 | | 2008-08-27 | Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Un… | |
CVE-2008-0322 | High | 7.8 | 2008-05-13 | The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which… |
CVE-2008-0884 | | 2008-04-04 | The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in Red Hat Enterpri… | |
CVE-2008-0662 | High | 7.8 | 2008-02-08 | The Auto Local Logon feature in Check Point VPN-1 SecuRemote/SecureClient NGX R60 and R56 for Windows caches credentials under the Checkpoint\SecuRemote regist… |
CVE-2007-6033 | High | 8.8 | 2007-11-20 | Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and poss… |
CVE-2007-5544 | High | 7.8 | 2007-10-29 | IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for me… |
CVE-2005-4868 | High | 7.1 | 2005-12-31 | Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local users to gain unauthoriz… |
CVE-2004-1714 | High | 7.1 | 2004-08-11 | BlackICE PC Protection and Server Protection installs (1) firewall.ini, (2) blackice.ini, (3) sigs.ini and (4) protect.ini with Everyone Full Control permissio… |
CVE-2001-0006 | High | 7.1 | 2001-02-12 | The Winsock2ProtocolCatalogMutex mutex in Windows NT 4.0 has inappropriate Everyone/Full Control permissions, which allows local users to modify the permission… |