CWE-732 · Incorrect Permission Assignment for Critical Resource (page 5)
Page 5 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11176 | | 2024-11-20 | Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluat… | |
CVE-2024-41974 | High | 7.1 | 2024-11-18 | A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS… |
CVE-2024-41970 | Medium | 5.7 | 2024-11-18 | A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources. |
CVE-2024-36294 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-36276 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-39709 | High | 7.8 | 2024-11-13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applica… |
CVE-2024-9842 | High | 7.3 | 2024-11-12 | Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. |
CVE-2024-47808 | High | 8.4 | 2024-11-12 | A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restr… |
CVE-2024-47783 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. … |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-45164 | High | 7.1 | 2024-11-04 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal befor… |
CVE-2024-10228 | Low | 3.8 | 2024-10-29 | The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing p… |
CVE-2024-0128 | High | 7.1 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of… |
CVE-2022-30354 | High | 7.5 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The… |
CVE-2024-46897 | Low | 3.8 | 2024-10-18 | Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permi… |
CVE-2023-6729 | High | 7.3 | 2024-10-17 | Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege… |
CVE-2024-22029 | High | 7.8 | 2024-10-16 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root |
CVE-2024-10018 | Critical | 9.8 | 2024-10-16 | Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. |
CVE-2024-44729 | High | 7.5 | 2024-10-11 | Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to a… |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2024-7612 | High | 8.8 | 2024-10-08 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. |
CVE-2024-24117 | Critical | 9.8 | 2024-10-02 | Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check stat… |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |
CVE-2024-9142 | Critical | 9.8 | 2024-09-25 | External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipul… |
CVE-2022-43845 | Low | 3.7 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote… |
CVE-2024-8900 | High | 7.5 | 2024-09-17 | An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects F… |
CVE-2024-8039 | Critical | 9.8 | 2024-09-14 | Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. |
CVE-2024-6510 | High | 7.8 | 2024-09-12 | Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. |
CVE-2024-44575 | Low | 3.7 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies… |
CVE-2024-41171 | High | 8.8 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMER… |
CVE-2024-45041 | High | 8.3 | 2024-09-09 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext… |
CVE-2024-38456 | High | 7.8 | 2024-09-03 | HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in pruns… |
CVE-2023-49582 | Medium | 5.5 | 2024-08-26 | Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially r… |
CVE-2022-43915 | Medium | 6.8 | 2024-08-24 | IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12… |
CVE-2024-7986 | High | 7.5 | 2024-08-23 | A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can expl… |
CVE-2024-5930 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2024-7513 | High | 8.8 | 2024-08-14 | CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing… |
CVE-2024-5915 | High | 7.8 | 2024-08-14 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-25561 | Medium | 6.7 | 2024-08-14 | Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enab… |
CVE-2024-23908 | Medium | 6.7 | 2024-08-14 | Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potential… |
CVE-2024-6619 | | 2024-08-13 | In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could caus… | |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-41820 | Medium | 6.0 | 2024-08-05 | Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malici… |
CVE-2024-41720 | High | 8.0 | 2024-08-05 | Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent… |
CVE-2024-41954 | Medium | 5.3 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings"… |
CVE-2024-31202 | High | 7.8 | 2024-07-31 | A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege… |
CVE-2022-33167 | Low | 3.7 | 2024-07-30 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caus… |
CVE-2024-27883 | Medium | 4.4 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app m… |
CVE-2024-41685 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web managemen… |
CVE-2024-1724 | Medium | 6.3 | 2024-07-25 | In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu… |
CVE-2024-5618 | Critical | 9.9 | 2024-07-18 | Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Pro… |
CVE-2024-6435 | High | 8.8 | 2024-07-16 | A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should… |
CVE-2024-6780 | Low | 3.3 | 2024-07-16 | Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. |
CVE-2024-6739 | Medium | 5.3 | 2024-07-15 | The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session… |
CVE-2024-20456 | Medium | 6.7 | 2024-07-10 | A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot… |
CVE-2024-28827 | High | 8.8 | 2024-07-10 | Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker… |
CVE-2024-39875 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticated, low privilege use… |
CVE-2024-37087 | Medium | 5.3 | 2024-06-25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-37369 | High | 8.8 | 2024-06-14 | A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lis… |
CVE-2024-36821 | Medium | 6.8 | 2024-06-11 | Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root. |
CVE-2024-3668 | High | 8.8 | 2024-06-08 | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the pl… |
CVE-2024-30369 | High | 7.8 | 2024-06-06 | A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2024-29078 | High | 7.5 | 2024-05-28 | Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker w… |
CVE-2024-21902 | Medium | 6.4 | 2024-05-21 | An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vu… |
CVE-2024-21835 | Medium | 6.7 | 2024-05-16 | Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-5936 | High | 7.8 | 2024-05-15 | On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be a… |
CVE-2024-27108 | Medium | 6.8 | 2024-05-14 | Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products |
CVE-2024-33499 | Critical | 9.1 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-30208 | Medium | 6.3 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-1486 | High | 7.4 | 2024-05-14 | Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices |
CVE-2023-35841 | High | 7.8 | 2024-05-14 | Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmwa… |
CVE-2023-47712 | High | 7.8 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X… |
CVE-2023-51579 | High | 7.8 | 2024-05-03 | Voltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2023-40516 | High | 7.8 | 2024-05-03 | LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2024-24912 | Medium | 6.7 | 2024-05-01 | A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulne… |
CVE-2024-33435 | Critical | 9.8 | 2024-04-29 | Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-… |
CVE-2024-3375 | Critical | 9.4 | 2024-04-29 | Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. … |
CVE-2024-2905 | Medium | 6.2 | 2024-04-25 | A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. Thi… |
CVE-2024-32478 | Medium | 6.9 | 2024-04-19 | Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows… |
CVE-2024-29964 | Medium | 5.7 | 2024-04-19 | Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the serv… |
CVE-2024-24910 | High | 7.3 | 2024-04-18 | A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows… |
CVE-2024-21063 | Medium | 6.1 | 2024-04-16 | Vulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft (component: Benefits Administration). The supported versi… |
CVE-2024-22334 | Medium | 4.4 | 2024-04-12 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 coul… |
CVE-2024-25646 | High | 7.7 | 2024-04-09 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using c… |
CVE-2023-52554 | Medium | 6.5 | 2024-04-08 | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52388 | High | 7.5 | 2024-04-08 | Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52715 | High | 7.5 | 2024-04-07 | The SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-30413 | High | 7.5 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-3250 | Medium | 6.5 | 2024-04-04 | It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local user… |
CVE-2024-28589 | Medium | 6.7 | 2024-04-03 | An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbitrary code and esca… |
CVE-2024-25956 | Medium | 5.5 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploi… |
CVE-2024-29187 | High | 7.3 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW… |
CVE-2024-28745 | Low | 3.3 | 2024-03-18 | Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device… |
CVE-2024-21431 | High | 7.8 | 2024-03-12 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability |
CVE-2024-28163 | Medium | 5.3 | 2024-03-12 | Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would oth… |
CVE-2024-25645 | Medium | 5.3 | 2024-03-12 | Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing l… |
CVE-2024-25644 | Medium | 5.3 | 2024-03-12 | Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on… |