CWE-732 · Incorrect Permission Assignment for Critical Resource (page 3)
Page 3 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64298 | High | 8.4 | 2025-12-02 | NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clie… |
CVE-2025-62575 | High | 8.3 | 2025-12-02 | NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have t… |
CVE-2025-59373 | | 2025-11-25 | A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged acto… | |
CVE-2025-11921 | | 2025-11-24 | iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iSt… | |
CVE-2025-64324 | High | 7.7 | 2025-11-18 | KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user w… |
CVE-2025-64996 | Medium | 4.4 | 2025-11-18 | In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writable files, allowing… |
CVE-2025-34323 | High | 7.8 | 2025-11-17 | Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable ap… |
CVE-2024-32014 | Medium | 4.7 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local databas… |
CVE-2024-32010 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6779 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can o… |
CVE-2025-64322 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files… |
CVE-2025-64319 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fi… |
CVE-2025-4952 | | 2025-10-31 | Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized… | |
CVE-2025-34287 | High | 7.8 | 2025-10-30 | Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-… |
CVE-2025-34135 | Medium | 4.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit… |
CVE-2025-11906 | Medium | 6.7 | 2025-10-30 | A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with… |
CVE-2025-54546 | High | 7.5 | 2025-10-29 | On affected platforms, restricted users could use SSH port forwarding to access host-internal services |
CVE-2025-54545 | High | 7.8 | 2025-10-29 | On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. |
CVE-2025-12148 | | 2025-10-29 | In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fie… | |
CVE-2025-12147 | | 2025-10-29 | In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule… | |
CVE-2025-62688 | High | 7.1 | 2025-10-23 | An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allo… |
CVE-2025-12004 | | 2025-10-21 | Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in… | |
CVE-2025-31702 | Medium | 6.8 | 2025-10-15 | A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability… |
CVE-2025-57741 | High | 7.8 | 2025-10-14 | An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions… |
CVE-2025-62251 | Medium | 6.5 | 2025-10-13 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though up… |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-10751 | High | 7.8 | 2025-10-04 | MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1. |
CVE-2025-34212 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess … |
CVE-2025-10541 | High | 7.8 | 2025-09-25 | iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechani… |
CVE-2025-43808 | Medium | 5.3 | 2025-09-19 | The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through upd… |
CVE-2025-34206 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/w… |
CVE-2025-34189 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deploymen… |
CVE-2025-54497 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and … |
CVE-2025-52873 | High | 8.1 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and d… |
CVE-2025-10643 | Critical | 9.1 | 2025-09-17 | Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication o… |
CVE-2025-59349 | Low | 3.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certa… |
CVE-2025-0164 | Low | 2.3 | 2025-09-14 | IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files du… |
CVE-2025-57392 | High | 7.8 | 2025-09-10 | BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILE_ALL_ACCE… |
CVE-2025-40804 | Critical | 9.1 | 2025-09-09 | A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without an… |
CVE-2025-41664 | High | 7.5 | 2025-09-08 | A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling d… |
CVE-2025-58372 | High | 8.1 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code worksp… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-23258 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to escalate privileges… |
CVE-2025-23257 | High | 7.3 | 2025-09-04 | NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate privileges. A successfu… |
CVE-2025-36193 | High | 8.4 | 2025-09-03 | IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a con… |
CVE-2025-43268 | High | 7.8 | 2025-08-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |
CVE-2025-9578 | High | 7.8 | 2025-08-28 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40… |
CVE-2025-53396 | High | 7.0 | 2025-08-28 | Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users… |
CVE-2025-43729 | High | 7.8 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local low-privileged attacke… |
CVE-2025-30063 | | 2025-08-27 | The configuration file containing database logins and passwords is readable by any local user. | |
CVE-2025-0093 | High | 7.5 | 2025-08-26 | In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote infor… |
CVE-2025-4609 | Critical | 9.6 | 2025-08-22 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
CVE-2025-43759 | Low | 2.7 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 202… |
CVE-2025-52094 | High | 7.8 | 2025-08-22 | Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy comp… |
CVE-2025-38742 | Medium | 5.3 | 2025-08-21 | Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged a… |
CVE-2025-55524 | High | 7.3 | 2025-08-21 | Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors. |
CVE-2025-27216 | High | 8.8 | 2025-08-21 | Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges. |
CVE-2025-1139 | Medium | 6.1 | 2025-08-20 | IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permis… |
CVE-2025-8042 | Critical | 9.8 | 2025-08-19 | Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141. |
CVE-2025-5819 | Medium | 5.0 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-50675 | High | 7.8 | 2025-08-07 | GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessib… |
CVE-2025-54618 | Medium | 5.7 | 2025-08-06 | Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2012-10030 | Critical | 9.8 | 2025-08-05 | FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system director… |
CVE-2025-46093 | Critical | 9.9 | 2025-08-04 | LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging… |
CVE-2025-41659 | High | 8.3 | 2025-08-04 | A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allo… |
CVE-2025-23285 | Medium | 5.5 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vuln… |
CVE-2025-45150 | Critical | 9.8 | 2025-08-01 | Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. |
CVE-2014-125121 | | 2025-07-31 | Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of h… | |
CVE-2025-43266 | Medium | 5.1 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43247 | Medium | 5.5 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicio… |
CVE-2025-43243 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-26469 | Critical | 9.3 | 2025-07-28 | An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially… |
CVE-2017-20198 | | 2025-07-23 | The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations… | |
CVE-2025-36104 | Medium | 6.5 | 2025-07-12 | IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited th… |
CVE-2023-39338 | Medium | 6.8 | 2025-07-12 | Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to acces… |
CVE-2025-30661 | High | 7.3 | 2025-07-11 | An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileg… |
CVE-2025-27446 | High | 7.8 | 2025-07-06 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin ru… |
CVE-2025-6297 | High | 8.2 | 2025-07-01 | It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is document… |
CVE-2025-52992 | Low | 3.2 | 2025-06-27 | The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the conten… |
CVE-2025-5995 | | 2025-06-26 | Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulner… | |
CVE-2024-11584 | Medium | 5.9 | 2025-06-26 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-wri… |
CVE-2025-36537 | High | 7.0 | 2025-06-24 | Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows a… |
CVE-2025-52923 | Medium | 4.3 | 2025-06-22 | Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command. |
CVE-2025-49131 | Medium | 6.3 | 2025-06-09 | FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox co… |
CVE-2025-48961 | High | 7.3 | 2025-06-04 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938. |
CVE-2024-45655 | Medium | 5.5 | 2025-06-03 | IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. |
CVE-2025-20298 | High | 8.0 | 2025-06-02 | In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-2503 | High | 7.1 | 2025-05-30 | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an ele… |
CVE-2025-48747 | Medium | 5.0 | 2025-05-28 | Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critic… |
CVE-2025-48382 | Medium | 5.5 | 2025-05-27 | Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary… |
CVE-2025-46802 | Medium | 6.0 | 2025-05-26 | For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. |
CVE-2025-40672 | | 2025-05-26 | A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the fi… | |
CVE-2025-45472 | High | 8.8 | 2025-05-22 | Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-45468 | High | 8.8 | 2025-05-22 | Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-45471 | High | 8.8 | 2025-05-22 | Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-32915 | Medium | 5.5 | 2025-05-22 | Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2… |
CVE-2025-3944 | High | 7.2 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File… |
CVE-2025-3936 | Medium | 6.5 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows all… |
CVE-2025-2759 | High | 7.8 | 2025-05-22 | GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |