CWE-732 · Incorrect Permission Assignment for Critical Resource (page 4)
Page 4 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9578 | High | 7.8 | 2025-08-28 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40… |
CVE-2025-53396 | High | 7.0 | 2025-08-28 | Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users… |
CVE-2025-43729 | High | 7.8 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local low-privileged attacke… |
CVE-2025-30063 | | 2025-08-27 | The configuration file containing database logins and passwords is readable by any local user. | |
CVE-2025-0093 | High | 7.5 | 2025-08-26 | In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote infor… |
CVE-2025-4609 | Critical | 9.6 | 2025-08-22 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
CVE-2025-43759 | Low | 2.7 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 202… |
CVE-2025-52094 | High | 7.8 | 2025-08-22 | Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy comp… |
CVE-2025-38742 | Medium | 5.3 | 2025-08-21 | Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged a… |
CVE-2025-55524 | High | 7.3 | 2025-08-21 | Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors. |
CVE-2025-27216 | High | 8.8 | 2025-08-21 | Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges. |
CVE-2025-1139 | Medium | 6.1 | 2025-08-20 | IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permis… |
CVE-2025-8042 | Critical | 9.8 | 2025-08-19 | Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141. |
CVE-2025-5819 | Medium | 5.0 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-50675 | High | 7.8 | 2025-08-07 | GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessib… |
CVE-2025-54618 | Medium | 5.7 | 2025-08-06 | Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2012-10030 | Critical | 9.8 | 2025-08-05 | FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system director… |
CVE-2025-46093 | Critical | 9.9 | 2025-08-04 | LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging… |
CVE-2025-41659 | High | 8.3 | 2025-08-04 | A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allo… |
CVE-2025-23285 | Medium | 5.5 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vuln… |
CVE-2025-45150 | Critical | 9.8 | 2025-08-01 | Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. |
CVE-2014-125121 | | 2025-07-31 | Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of h… | |
CVE-2025-43266 | Medium | 5.1 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-43247 | Medium | 5.5 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicio… |
CVE-2025-43243 | Critical | 9.8 | 2025-07-30 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
CVE-2025-26469 | Critical | 9.3 | 2025-07-28 | An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially… |
CVE-2017-20198 | | 2025-07-23 | The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations… | |
CVE-2025-36104 | Medium | 6.5 | 2025-07-12 | IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited th… |
CVE-2023-39338 | Medium | 6.8 | 2025-07-12 | Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to acces… |
CVE-2025-30661 | High | 7.3 | 2025-07-11 | An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileg… |
CVE-2025-27446 | High | 7.8 | 2025-07-06 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin ru… |
CVE-2025-6297 | High | 8.2 | 2025-07-01 | It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is document… |
CVE-2025-52992 | Low | 3.2 | 2025-06-27 | The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the conten… |
CVE-2025-5995 | | 2025-06-26 | Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulner… | |
CVE-2024-11584 | Medium | 5.9 | 2025-06-26 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-wri… |
CVE-2025-36537 | High | 7.0 | 2025-06-24 | Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows a… |
CVE-2025-52923 | Medium | 4.3 | 2025-06-22 | Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command. |
CVE-2025-49131 | Medium | 6.3 | 2025-06-09 | FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox co… |
CVE-2025-48961 | High | 7.3 | 2025-06-04 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938. |
CVE-2024-45655 | Medium | 5.5 | 2025-06-03 | IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. |
CVE-2025-20298 | High | 8.0 | 2025-06-02 | In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in inco… |
CVE-2025-2503 | High | 7.1 | 2025-05-30 | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an ele… |
CVE-2025-48747 | Medium | 5.0 | 2025-05-28 | Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critic… |
CVE-2025-48382 | Medium | 5.5 | 2025-05-27 | Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary… |
CVE-2025-46802 | Medium | 6.0 | 2025-05-26 | For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. |
CVE-2025-40672 | | 2025-05-26 | A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the fi… | |
CVE-2025-45472 | High | 8.8 | 2025-05-22 | Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-45468 | High | 8.8 | 2025-05-22 | Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-45471 | High | 8.8 | 2025-05-22 | Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account. |
CVE-2025-32915 | Medium | 5.5 | 2025-05-22 | Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2… |
CVE-2025-3944 | High | 7.2 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File… |
CVE-2025-3936 | Medium | 6.5 | 2025-05-22 | Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows all… |
CVE-2025-2759 | High | 7.8 | 2025-05-22 | GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-34025 | High | 8.8 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting… |
CVE-2025-31262 | Medium | 5.5 | 2025-05-19 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, w… |
CVE-2025-40574 | High | 7.8 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to… |
CVE-2025-40572 | Medium | 5.5 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to… |
CVE-2025-24009 | Medium | 5.9 | 2025-05-13 | A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices d… |
CVE-2025-42997 | Medium | 6.6 | 2025-05-13 | Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the pos… |
CVE-2025-26169 | High | 8.1 | 2025-05-07 | IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be contr… |
CVE-2025-26168 | High | 8.1 | 2025-05-07 | IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be… |
CVE-2025-23245 | Medium | 5.5 | 2025-05-01 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to access global resource… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-3394 | High | 7.8 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. |
CVE-2025-30408 | Medium | 6.7 | 2025-04-24 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39… |
CVE-2025-0926 | Medium | 5.9 | 2025-04-23 | Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop… |
CVE-2025-1731 | High | 7.8 | 2025-04-22 | An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could… |
CVE-2025-0758 | Medium | 6.1 | 2025-04-16 | Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors… |
CVE-2025-30708 | High | 7.5 | 2025-04-15 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users). Supported versions that are affected ar… |
CVE-2025-30688 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30687 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-30685 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30684 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30683 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |
CVE-2025-30682 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21585 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21584 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9… |
CVE-2025-21583 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.0 and 9.0.0. Easily exploita… |
CVE-2025-21581 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21580 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9… |
CVE-2025-21579 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2025-21578 | Medium | 6.7 | 2025-04-15 | Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18… |
CVE-2024-13861 | High | 7.8 | 2025-04-11 | A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code ex… |
CVE-2025-25041 | Medium | 5.5 | 2025-04-01 | A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTE… |
CVE-2025-20233 | Low | 2.5 | 2025-03-26 | In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in… |
CVE-2025-2098 | | 2025-03-26 | Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security p… | |
CVE-2025-25373 | Critical | 9.8 | 2025-03-25 | The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform. |
CVE-2024-10209 | | 2025-03-25 | An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker t… | |
CVE-2025-27688 | High | 7.8 | 2025-03-18 | Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerab… |
CVE-2025-27591 | Medium | 6.8 | 2025-03-11 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This cou… |
CVE-2025-22454 | High | 7.8 | 2025-03-11 | Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. |
CVE-2025-1413 | | 2025-02-28 | DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, wh… | |
CVE-2025-1067 | High | 7.3 | 2025-02-25 | There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file… |
CVE-2025-27141 | Medium | 6.5 | 2025-02-24 | Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to ve… |
CVE-2024-13813 | High | 7.1 | 2025-02-11 | Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files. |
CVE-2025-23403 | High | 7.0 | 2025-02-11 | A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restric… |
CVE-2025-0064 | High | 8.7 | 2025-02-11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to gen… |
CVE-2024-57520 | Critical | 9.8 | 2025-02-05 | Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is dispu… |
CVE-2024-57068 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-45657 | Medium | 5.0 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect p… |