CWE-732 · Incorrect Permission Assignment for Critical Resource (page 6)
Page 6 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31202 | High | 7.8 | 2024-07-31 | A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege… |
CVE-2022-33167 | Low | 3.7 | 2024-07-30 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caus… |
CVE-2024-27883 | Medium | 4.4 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app m… |
CVE-2024-41685 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web managemen… |
CVE-2024-1724 | Medium | 6.3 | 2024-07-25 | In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu… |
CVE-2024-5618 | Critical | 9.9 | 2024-07-18 | Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Pro… |
CVE-2024-6435 | High | 8.8 | 2024-07-16 | A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should… |
CVE-2024-6780 | Low | 3.3 | 2024-07-16 | Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. |
CVE-2024-6739 | Medium | 5.3 | 2024-07-15 | The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session… |
CVE-2024-20456 | Medium | 6.7 | 2024-07-10 | A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot… |
CVE-2024-28827 | High | 8.8 | 2024-07-10 | Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker… |
CVE-2024-39875 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticated, low privilege use… |
CVE-2024-37087 | Medium | 5.3 | 2024-06-25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-37369 | High | 8.8 | 2024-06-14 | A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lis… |
CVE-2024-36821 | Medium | 6.8 | 2024-06-11 | Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root. |
CVE-2024-3668 | High | 8.8 | 2024-06-08 | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the pl… |
CVE-2024-30369 | High | 7.8 | 2024-06-06 | A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2024-29078 | High | 7.5 | 2024-05-28 | Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker w… |
CVE-2024-21902 | Medium | 6.4 | 2024-05-21 | An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vu… |
CVE-2024-21835 | Medium | 6.7 | 2024-05-16 | Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-5936 | High | 7.8 | 2024-05-15 | On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be a… |
CVE-2024-27108 | Medium | 6.8 | 2024-05-14 | Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products |
CVE-2024-33499 | Critical | 9.1 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-30208 | Medium | 6.3 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-1486 | High | 7.4 | 2024-05-14 | Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices |
CVE-2023-35841 | High | 7.8 | 2024-05-14 | Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmwa… |
CVE-2023-47712 | High | 7.8 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X… |
CVE-2023-51579 | High | 7.8 | 2024-05-03 | Voltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2023-40516 | High | 7.8 | 2024-05-03 | LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2024-24912 | Medium | 6.7 | 2024-05-01 | A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulne… |
CVE-2024-33435 | Critical | 9.8 | 2024-04-29 | Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-… |
CVE-2024-3375 | Critical | 9.4 | 2024-04-29 | Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. … |
CVE-2024-2905 | Medium | 6.2 | 2024-04-25 | A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. Thi… |
CVE-2024-32478 | Medium | 6.9 | 2024-04-19 | Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows… |
CVE-2024-29964 | Medium | 5.7 | 2024-04-19 | Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the serv… |
CVE-2024-24910 | High | 7.3 | 2024-04-18 | A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows… |
CVE-2024-21063 | Medium | 6.1 | 2024-04-16 | Vulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft (component: Benefits Administration). The supported versi… |
CVE-2024-22334 | Medium | 4.4 | 2024-04-12 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 coul… |
CVE-2024-25646 | High | 7.7 | 2024-04-09 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using c… |
CVE-2023-52554 | Medium | 6.5 | 2024-04-08 | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52388 | High | 7.5 | 2024-04-08 | Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52715 | High | 7.5 | 2024-04-07 | The SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-30413 | High | 7.5 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-3250 | Medium | 6.5 | 2024-04-04 | It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local user… |
CVE-2024-28589 | Medium | 6.7 | 2024-04-03 | An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbitrary code and esca… |
CVE-2024-25956 | Medium | 5.5 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploi… |
CVE-2024-29187 | High | 7.3 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW… |
CVE-2024-28745 | Low | 3.3 | 2024-03-18 | Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device… |
CVE-2024-21431 | High | 7.8 | 2024-03-12 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability |
CVE-2024-28163 | Medium | 5.3 | 2024-03-12 | Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would oth… |
CVE-2024-25645 | Medium | 5.3 | 2024-03-12 | Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing l… |
CVE-2024-25644 | Medium | 5.3 | 2024-03-12 | Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on… |
CVE-2024-27294 | High | 7.3 | 2024-02-29 | dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership wh… |
CVE-2024-0019 | Medium | 5.0 | 2024-02-16 | In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check… |
CVE-2024-21915 | Critical | 9.0 | 2024-02-16 | A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group… |
CVE-2023-33870 | Medium | 6.7 | 2024-02-14 | Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of… |
CVE-2024-24740 | Medium | 5.3 | 2024-02-13 | SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, un… |
CVE-2023-50292 | High | 7.5 | 2024-02-09 | Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects… |
CVE-2023-34042 | Medium | 4.1 | 2024-02-05 | The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with… |
CVE-2023-47564 | High | 8.0 | 2024-02-02 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow a… |
CVE-2020-24681 | High | 8.2 | 2024-02-02 | Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affec… |
CVE-2024-22016 | High | 7.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege esc… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2023-48714 | Medium | 4.3 | 2024-01-23 | Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user shou… |
CVE-2024-23223 | Medium | 6.2 | 2024-01-23 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An… |
CVE-2023-38541 | Medium | 6.7 | 2024-01-19 | Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may a… |
CVE-2023-52116 | High | 7.5 | 2024-01-16 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-52107 | High | 7.5 | 2024-01-16 | Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2020-36770 | Critical | 9.8 | 2024-01-15 | pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This cou… |
CVE-2023-49257 | High | 8.8 | 2024-01-12 | An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges. |
CVE-2023-6883 | Medium | 4.3 | 2024-01-11 | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in al… |
CVE-2023-6506 | Medium | 4.3 | 2024-01-11 | The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-21305 | Medium | 4.4 | 2024-01-09 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability |
CVE-2023-44120 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative acco… |
CVE-2023-41776 | Medium | 6.7 | 2024-01-03 | There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate loc… |
CVE-2023-7055 | Medium | 4.3 | 2023-12-22 | A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profi… |
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2023-46141 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated at… |
CVE-2023-0757 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated… |
CVE-2023-25648 | Medium | 6.5 | 2023-12-14 | There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could… |
CVE-2023-6593 | Critical | 9.8 | 2023-12-12 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to ex… |
CVE-2023-49580 | High | 7.3 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access inf… |
CVE-2023-49578 | Low | 3.5 | 2023-12-12 | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious… |
CVE-2023-42924 | Medium | 5.5 | 2023-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user d… |
CVE-2023-50446 | High | 7.8 | 2023-12-10 | An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate p… |
CVE-2023-49797 | High | 8.8 | 2023-12-09 | PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may… |
CVE-2023-40302 | Critical | 9.1 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability |
CVE-2023-49946 | Critical | 9.1 | 2023-12-03 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remot… |
CVE-2023-29065 | Medium | 4.1 | 2023-11-28 | The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potent… |
CVE-2023-5651 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a… |
CVE-2023-6179 | High | 7.8 | 2023-11-17 | Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti… |
CVE-2023-48087 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. |
CVE-2023-39230 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enab… |
CVE-2023-34997 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to p… |
CVE-2023-34314 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation… |
CVE-2022-41700 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentia… |
CVE-2022-33898 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially… |
CVE-2023-36633 | Medium | 5.4 | 2023-11-14 | An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and… |
CVE-2023-47801 | Medium | 4.7 | 2023-11-13 | An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delet… |