CWE-732 · Incorrect Permission Assignment for Critical Resource (page 7)
Page 7 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35799 | Medium | 5.5 | 2023-06-27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary f… |
CVE-2023-35168 | Medium | 6.5 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privileg… |
CVE-2023-29860 | High | 7.5 | 2023-06-23 | An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie metho… |
CVE-2023-34981 | High | 7.5 | 2023-06-21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP S… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |
CVE-2023-34154 | High | 8.2 | 2023-06-16 | Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windo… |
CVE-2023-34797 | Medium | 5.4 | 2023-06-15 | Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information. |
CVE-2023-34852 | Critical | 9.8 | 2023-06-15 | PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions. |
CVE-2023-21142 | Medium | 5.5 | 2023-06-15 | In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with n… |
CVE-2022-33163 | Medium | 5.3 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unint… |
CVE-2023-35147 | Medium | 6.5 | 2023-06-14 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with I… |
CVE-2023-31142 | Low | 2.0 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-33695 | High | 7.1 | 2023-06-13 | Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java. |
CVE-2023-31238 | Medium | 5.5 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P8… |
CVE-2023-30897 | High | 7.8 | 2023-06-13 | A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation… |
CVE-2023-2876 | Low | 3.1 | 2023-06-13 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware mod… |
CVE-2023-32114 | Low | 2.7 | 2023-06-13 | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privilege… |
CVE-2023-28399 | High | 7.8 | 2023-06-01 | Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriat… |
CVE-2023-28346 | High | 7.3 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed a… |
CVE-2022-41766 | Medium | 4.3 | 2023-05-29 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyro… |
CVE-2023-31874 | High | 8.8 | 2023-05-29 | Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process'). |
CVE-2023-31748 | High | 7.8 | 2023-05-24 | Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file. |
CVE-2023-31454 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31453 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-33251 | Medium | 4.7 | 2023-05-21 | When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions… |
CVE-2023-1692 | High | 7.5 | 2023-05-20 | The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-31871 | High | 7.8 | 2023-05-18 | OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software come… |
CVE-2023-33004 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. |
CVE-2023-32992 | High | 8.8 | 2023-05-16 | Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to… |
CVE-2023-32990 | Medium | 6.5 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-32986 | High | 8.8 | 2023-05-16 | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowin… |
CVE-2023-32979 | Medium | 4.3 | 2023-05-16 | Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to… |
CVE-2023-32303 | Medium | 5.2 | 2023-05-12 | Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the u… |
CVE-2023-28522 | Medium | 4.3 | 2023-05-12 | IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585. |
CVE-2023-31445 | Medium | 5.3 | 2023-05-11 | Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have… |
CVE-2022-46656 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation… |
CVE-2022-41771 | Medium | 6.5 | 2023-05-10 | Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentia… |
CVE-2022-41699 | High | 8.2 | 2023-05-10 | Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentia… |
CVE-2022-41658 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalati… |
CVE-2022-38103 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially en… |
CVE-2023-29092 | Low | 3.1 | 2023-05-09 | An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding of a wrong resource… |
CVE-2023-2478 | Critical | 9.6 | 2023-05-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all vers… |
CVE-2021-40331 | High | 8.1 | 2023-05-05 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database… |
CVE-2023-28068 | High | 7.3 | 2023-05-05 | Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authenticated malicious user can potentially expl… |
CVE-2023-30399 | High | 8.1 | 2023-05-04 | Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man… |
CVE-2023-25438 | High | 7.8 | 2023-05-04 | An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific fi… |
CVE-2023-0834 | High | 7.0 | 2023-04-28 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce… |
CVE-2023-0207 | High | 7.5 | 2023-04-22 | NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful e… |
CVE-2023-28123 | Medium | 5.5 | 2023-04-19 | A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting… |
CVE-2023-30606 | Medium | 4.2 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSe… |
CVE-2023-22294 | High | 8.8 | 2023-04-18 | Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. |
CVE-2023-28960 | High | 8.2 | 2023-04-17 | An Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved allows a local, authenticated low-privileged attack… |
CVE-2023-30512 | Medium | 6.5 | 2023-04-12 | CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets… |
CVE-2023-1939 | Medium | 4.3 | 2023-04-11 | No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager L… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2023-24626 | Medium | 6.5 | 2023-04-08 | socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a p… |
CVE-2022-43309 | Medium | 5.5 | 2023-04-07 | Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. |
CVE-2023-0944 | Medium | 4.3 | 2023-04-05 | Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password… |
CVE-2023-0225 | Medium | 4.3 | 2023-04-03 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any ob… |
CVE-2022-43773 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configu… |
CVE-2023-1516 | High | 7.9 | 2023-03-28 | RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a local user to escalate p… |
CVE-2023-25817 | Low | 3.5 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete… |
CVE-2023-1135 | High | 7.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which co… |
CVE-2023-27096 | Medium | 6.5 | 2023-03-27 | Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function o… |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2023-27095 | Medium | 6.5 | 2023-03-16 | Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController functi… |
CVE-2023-27084 | Medium | 5.3 | 2023-03-16 | Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter. |
CVE-2023-23939 | Low | 3.9 | 2023-03-06 | Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a f… |
CVE-2023-24205 | Critical | 9.8 | 2023-02-23 | Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw… |
CVE-2021-3172 | High | 8.1 | 2023-02-17 | An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. |
CVE-2022-25992 | High | 7.5 | 2023-02-16 | Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2021-37306 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: a… |
CVE-2021-37305 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /… |
CVE-2021-37304 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the ht… |
CVE-2023-22326 | Medium | 4.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions… |
CVE-2022-42972 | High | 7.8 | 2023-02-01 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifie… |
CVE-2022-44715 | High | 8.8 | 2023-01-27 | Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload. |
CVE-2022-44263 | High | 7.8 | 2023-01-26 | Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control. |
CVE-2023-23610 | Medium | 6.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having a… |
CVE-2023-20923 | Medium | 5.5 | 2023-01-26 | In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead… |
CVE-2023-22592 | Medium | 4.0 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission set… |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2022-48257 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp. |
CVE-2022-39186 | Medium | 6.2 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions |
CVE-2022-47927 | Medium | 5.5 | 2023-01-12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data dir… |
CVE-2022-4365 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4630 | Medium | 5.3 | 2022-12-21 | Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. |
CVE-2022-42949 | High | 7.5 | 2022-12-21 | Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. |
CVE-2022-43517 | High | 7.8 | 2022-12-13 | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306). The affected application improperly assigns file permissions to installation… |
CVE-2022-23143 | Medium | 6.5 | 2022-12-05 | ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use… |
CVE-2022-46338 | Medium | 6.5 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowin… |
CVE-2022-45307 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\… |
CVE-2022-45306 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the… |
CVE-2022-45305 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Py… |
CVE-2022-45304 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmd… |
CVE-2022-45301 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\rub… |
CVE-2022-41926 | Low | 3.3 | 2022-11-25 | Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermi… |