CWE-732 · Incorrect Permission Assignment for Critical Resource (page 6)
Page 6 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27294 | High | 7.3 | 2024-02-29 | dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership wh… |
CVE-2024-0019 | Medium | 5.0 | 2024-02-16 | In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check… |
CVE-2024-21915 | Critical | 9.0 | 2024-02-16 | A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group… |
CVE-2023-33870 | Medium | 6.7 | 2024-02-14 | Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of… |
CVE-2024-24740 | Medium | 5.3 | 2024-02-13 | SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, un… |
CVE-2023-50292 | High | 7.5 | 2024-02-09 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects… |
CVE-2023-34042 | Medium | 4.1 | 2024-02-05 | The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with… |
CVE-2023-47564 | High | 8.0 | 2024-02-02 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow a… |
CVE-2020-24681 | High | 8.2 | 2024-02-02 | Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affec… |
CVE-2024-22016 | High | 7.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege esc… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2023-48714 | Medium | 4.3 | 2024-01-23 | Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user shou… |
CVE-2024-23223 | Medium | 6.2 | 2024-01-23 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An… |
CVE-2023-38541 | Medium | 6.7 | 2024-01-19 | Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may a… |
CVE-2023-52116 | High | 7.5 | 2024-01-16 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-52107 | High | 7.5 | 2024-01-16 | Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2020-36770 | Critical | 9.8 | 2024-01-15 | pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This cou… |
CVE-2023-49257 | High | 8.8 | 2024-01-12 | An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges. |
CVE-2023-6883 | Medium | 4.3 | 2024-01-11 | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in al… |
CVE-2023-6506 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-21305 | Medium | 4.4 | 2024-01-09 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability |
CVE-2023-44120 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative acco… |
CVE-2023-41776 | Medium | 6.7 | 2024-01-03 | There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate loc… |
CVE-2023-7055 | Medium | 4.3 | 2023-12-22 | A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profi… |
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2023-46141 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated at… |
CVE-2023-0757 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated… |
CVE-2023-25648 | Medium | 6.5 | 2023-12-14 | There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could… |
CVE-2023-6593 | Critical | 9.8 | 2023-12-12 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to ex… |
CVE-2023-49580 | High | 7.3 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access inf… |
CVE-2023-49578 | Low | 3.5 | 2023-12-12 | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious… |
CVE-2023-42924 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user d… |
CVE-2023-50446 | High | 7.8 | 2023-12-10 | An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate p… |
CVE-2023-49797 | High | 8.8 | 2023-12-09 | PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may… |
CVE-2023-40302 | Critical | 9.1 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability |
CVE-2023-49946 | Critical | 9.1 | 2023-12-03 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remot… |
CVE-2023-29065 | Medium | 4.1 | 2023-11-28 | The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potent… |
CVE-2023-5651 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a… |
CVE-2023-6179 | High | 7.8 | 2023-11-17 | Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti… |
CVE-2023-48087 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. |
CVE-2023-39230 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enab… |
CVE-2023-34997 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to p… |
CVE-2023-34314 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation… |
CVE-2022-41700 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentia… |
CVE-2022-33898 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially… |
CVE-2023-36633 | Medium | 5.4 | 2023-11-14 | An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and… |
CVE-2023-47801 | Medium | 4.7 | 2023-11-13 | An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delet… |
CVE-2023-28134 | High | 7.8 | 2023-11-12 | Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the… |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-5136 | Medium | 5.5 | 2023-11-08 | An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability b… |
CVE-2023-46449 | High | 8.8 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of an… |
CVE-2023-42861 | Medium | 6.5 | 2023-10-25 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentia… |
CVE-2023-42489 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource |
CVE-2023-40361 | High | 7.8 | 2023-10-20 | SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user t… |
CVE-2023-34437 | High | 7.5 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an at… |
CVE-2023-44201 | Medium | 5.0 | 2023-10-13 | An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local aut… |
CVE-2023-32724 | Critical | 9.1 | 2023-10-12 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
CVE-2023-32723 | High | 8.5 | 2023-10-12 | Request to LDAP is sent before user permissions are checked. |
CVE-2023-45205 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders wit… |
CVE-2023-38640 | Medium | 6.6 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders wit… |
CVE-2022-30527 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing… |
CVE-2023-42189 | High | 7.5 | 2023-10-10 | Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42… |
CVE-2023-45369 | Medium | 4.3 | 2023-10-09 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of h… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-44387 | Low | 3.2 | 2023-10-05 | Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2023-20254 | High | 7.2 | 2023-09-27 | A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to acc… |
CVE-2023-4565 | Medium | 5.3 | 2023-09-27 | Broadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may cause the hotspot feature to be unavailab… |
CVE-2023-41295 | Medium | 5.3 | 2023-09-25 | Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim. |
CVE-2023-4665 | High | 8.8 | 2023-09-15 | Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-38557 | High | 8.2 | 2023-09-14 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This… |
CVE-2023-40622 | Critical | 9.9 | 2023-09-12 | SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view… |
CVE-2023-32005 | Medium | 5.3 | 2023-09-12 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2023-4777 | Low | 3.1 | 2023-09-08 | An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while… |
CVE-2023-32162 | High | 7.8 | 2023-09-06 | Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2023-3915 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2023-34391 | High | 7.4 | 2023-08-31 | Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulatin… |
CVE-2023-40754 | High | 8.8 | 2023-08-28 | In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take… |
CVE-2023-4228 | Low | 3.1 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set pro… |
CVE-2023-20234 | Medium | 4.4 | 2023-08-23 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an a… |
CVE-2023-20230 | Medium | 5.4 | 2023-08-23 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2023-20200 | High | 7.7 | 2023-08-23 | A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliance… |
CVE-2023-4383 | High | 7.8 | 2023-08-16 | A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot… |
CVE-2023-4332 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file |
CVE-2023-28658 | Medium | 6.7 | 2023-08-11 | Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-39005 | High | 7.5 | 2023-08-09 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. |
CVE-2023-39004 | Critical | 9.8 | 2023-08-09 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to ac… |
CVE-2023-39003 | High | 7.5 | 2023-08-09 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. |
CVE-2022-39062 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for product folders. Thi… |
CVE-2023-38497 | High | 7.9 | 2023-08-04 | Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not res… |
CVE-2023-38991 | Medium | 5.4 | 2023-08-04 | An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Ad… |
CVE-2023-20216 | Medium | 4.4 | 2023-08-03 | A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileg… |
CVE-2023-3322 | High | 7.0 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-28133 | High | 7.8 | 2023-07-23 | Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file |
CVE-2023-35870 | Medium | 6.3 | 2023-07-11 | When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the sav… |
CVE-2023-33990 | High | 7.8 | 2023-07-11 | SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privil… |
CVE-2022-44719 | High | 7.5 | 2023-06-29 | An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions. |
CVE-2023-37237 | Medium | 6.5 | 2023-06-29 | In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary ope… |
CVE-2023-35800 | Medium | 4.3 | 2023-06-27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent… |