CWE-732 · Incorrect Permission Assignment for Critical Resource (page 5)
Page 5 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0374 | Medium | 6.5 | 2025-01-30 | When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not… |
CVE-2025-24527 | High | 8.0 | 2025-01-29 | An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can ex… |
CVE-2024-29869 | Medium | 5.5 | 2025-01-28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A… |
CVE-2025-24481 | | 2025-01-28 | An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assign… | |
CVE-2024-57547 | High | 7.5 | 2025-01-27 | Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of dow… |
CVE-2024-46881 | High | 7.1 | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise C… |
CVE-2024-52328 | Low | 2.3 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can d… |
CVE-2025-21571 | High | 7.3 | 2025-01-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and pr… |
CVE-2025-21566 | Medium | 6.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.1.0 and prior. Easily exp… |
CVE-2025-21564 | High | 8.1 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affecte… |
CVE-2025-21551 | Medium | 6.0 | 2025-01-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: File system). The supported version that is affected is 11. Easily exploitable vuln… |
CVE-2025-21523 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21520 | Low | 1.8 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and p… |
CVE-2025-0590 | High | 7.5 | 2025-01-20 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2024-38337 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive informat… |
CVE-2024-51448 | Medium | 6.7 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the inst… |
CVE-2025-21325 | High | 7.8 | 2025-01-17 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2024-39967 | Medium | 6.5 | 2025-01-15 | Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command. |
CVE-2024-11497 | High | 8.8 | 2025-01-14 | An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access. |
CVE-2025-0066 | Critical | 9.9 | 2025-01-14 | Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due… |
CVE-2024-54910 | Medium | 4.7 | 2025-01-10 | Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. |
CVE-2023-38037 | Medium | 5.5 | 2025-01-09 | ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's curren… |
CVE-2024-55411 | High | 8.8 | 2025-01-07 | An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOC… |
CVE-2024-53932 | Critical | 9.1 | 2025-01-06 | The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (… |
CVE-2024-53931 | Critical | 9.1 | 2025-01-06 | The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place p… |
CVE-2024-47475 | Medium | 5.0 | 2025-01-06 | Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally authenticated attacker… |
CVE-2024-49385 | Medium | 5.5 | 2025-01-02 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acro… |
CVE-2024-55955 | Medium | 6.7 | 2024-12-31 | An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local at… |
CVE-2024-45497 | High | 7.6 | 2024-12-31 | A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kube… |
CVE-2024-38864 | Low | 3.3 | 2024-12-19 | Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p23, < 2.2.0p38 and <= 2.1.0p49 (EOL) allows a local attacker to read sen… |
CVE-2024-47104 | Medium | 6.8 | 2024-12-18 | IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on… |
CVE-2024-12564 | | 2024-12-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Ser… | |
CVE-2024-12255 | Medium | 5.3 | 2024-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf… |
CVE-2024-12363 | High | 7.1 | 2024-12-11 | Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arb… |
CVE-2024-8540 | High | 8.8 | 2024-12-10 | Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application componen… |
CVE-2024-7572 | High | 7.1 | 2024-12-10 | Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. |
CVE-2024-10256 | High | 7.1 | 2024-12-10 | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. |
CVE-2024-8256 | | 2024-12-10 | In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect… | |
CVE-2024-41647 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-11220 | High | 7.8 | 2024-12-06 | A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server syste… |
CVE-2024-45841 | Medium | 6.5 | 2024-12-05 | Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an… |
CVE-2024-12151 | Medium | 5.0 | 2024-12-04 | Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. |
CVE-2024-12149 | High | 8.1 | 2024-12-04 | Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authe… |
CVE-2024-37574 | High | 8.2 | 2024-12-04 | The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interact… |
CVE-2024-42449 | High | 7.1 | 2024-12-04 | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the… |
CVE-2024-54159 | Medium | 4.1 | 2024-11-29 | stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. |
CVE-2024-21703 | Medium | 6.4 | 2024-11-27 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. … |
CVE-2024-28955 | Medium | 5.9 | 2024-11-26 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files… |
CVE-2024-9245 | High | 7.8 | 2024-11-22 | Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate… |
CVE-2024-9244 | High | 7.8 | 2024-11-22 | Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate… |
CVE-2024-7245 | High | 7.8 | 2024-11-22 | Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2024-6871 | High | 7.8 | 2024-11-22 | G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2024-38646 | Medium | 6.0 | 2024-11-22 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow… |
CVE-2024-11176 | | 2024-11-20 | Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluat… | |
CVE-2024-41974 | High | 7.1 | 2024-11-18 | A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS… |
CVE-2024-41970 | Medium | 5.7 | 2024-11-18 | A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources. |
CVE-2024-36294 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-36276 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-39709 | High | 7.8 | 2024-11-13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applica… |
CVE-2024-9842 | High | 7.3 | 2024-11-12 | Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. |
CVE-2024-47808 | High | 8.4 | 2024-11-12 | A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restr… |
CVE-2024-47783 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. … |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-45164 | High | 7.1 | 2024-11-04 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal befor… |
CVE-2024-10228 | Low | 3.8 | 2024-10-29 | The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing p… |
CVE-2024-0128 | High | 7.1 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of… |
CVE-2022-30354 | High | 7.5 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The… |
CVE-2024-46897 | Low | 3.8 | 2024-10-18 | Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permi… |
CVE-2023-6729 | High | 7.3 | 2024-10-17 | Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege… |
CVE-2024-22029 | High | 7.8 | 2024-10-16 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root |
CVE-2024-10018 | Critical | 9.8 | 2024-10-16 | Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. |
CVE-2024-44729 | High | 7.5 | 2024-10-11 | Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to a… |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2024-7612 | High | 8.8 | 2024-10-08 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. |
CVE-2024-24117 | Critical | 9.8 | 2024-10-02 | Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check stat… |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |
CVE-2024-9142 | Critical | 9.8 | 2024-09-25 | External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipul… |
CVE-2022-43845 | Low | 3.7 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote… |
CVE-2024-8900 | High | 7.5 | 2024-09-17 | An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects F… |
CVE-2024-8039 | Critical | 9.8 | 2024-09-14 | Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. |
CVE-2024-6510 | High | 7.8 | 2024-09-12 | Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. |
CVE-2024-44575 | Low | 3.7 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies… |
CVE-2024-41171 | High | 8.8 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMER… |
CVE-2024-45041 | High | 8.3 | 2024-09-09 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext… |
CVE-2024-38456 | High | 7.8 | 2024-09-03 | HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in pruns… |
CVE-2023-49582 | Medium | 5.5 | 2024-08-26 | Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially r… |
CVE-2022-43915 | Medium | 6.8 | 2024-08-24 | IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12… |
CVE-2024-7986 | High | 7.5 | 2024-08-23 | A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can expl… |
CVE-2024-5930 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2024-7513 | High | 8.8 | 2024-08-14 | CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing… |
CVE-2024-5915 | High | 7.8 | 2024-08-14 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-25561 | Medium | 6.7 | 2024-08-14 | Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enab… |
CVE-2024-23908 | Medium | 6.7 | 2024-08-14 | Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potential… |
CVE-2024-6619 | | 2024-08-13 | In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could caus… | |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-41820 | Medium | 6.0 | 2024-08-05 | Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malici… |
CVE-2024-41720 | High | 8.0 | 2024-08-05 | Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent… |
CVE-2024-41954 | Medium | 5.3 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings"… |