CWE-732 · Incorrect Permission Assignment for Critical Resource (page 7)
Page 7 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28134 | High | 7.8 | 2023-11-12 | Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the… |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-5136 | Medium | 5.5 | 2023-11-08 | An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability b… |
CVE-2023-46449 | High | 8.8 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of an… |
CVE-2023-42861 | Medium | 6.5 | 2023-10-25 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentia… |
CVE-2023-42489 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource |
CVE-2023-40361 | High | 7.8 | 2023-10-20 | SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user t… |
CVE-2023-34437 | High | 7.5 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an at… |
CVE-2023-44201 | Medium | 5.0 | 2023-10-13 | An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local aut… |
CVE-2023-32724 | Critical | 9.1 | 2023-10-12 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
CVE-2023-32723 | High | 8.5 | 2023-10-12 | Request to LDAP is sent before user permissions are checked. |
CVE-2023-45205 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders wit… |
CVE-2023-38640 | Medium | 6.6 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders wit… |
CVE-2022-30527 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing… |
CVE-2023-42189 | High | 7.5 | 2023-10-10 | Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42… |
CVE-2023-45369 | Medium | 4.3 | 2023-10-09 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of h… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-44387 | Low | 3.2 | 2023-10-05 | Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2023-20254 | High | 7.2 | 2023-09-27 | A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to acc… |
CVE-2023-4565 | Medium | 5.3 | 2023-09-27 | Broadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may cause the hotspot feature to be unavailab… |
CVE-2023-41295 | Medium | 5.3 | 2023-09-25 | Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim. |
CVE-2023-4665 | High | 8.8 | 2023-09-15 | Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-38557 | High | 8.2 | 2023-09-14 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This… |
CVE-2023-40622 | Critical | 9.9 | 2023-09-12 | SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view… |
CVE-2023-32005 | Medium | 5.3 | 2023-09-12 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a no… |
CVE-2023-4777 | Low | 3.1 | 2023-09-08 | An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while… |
CVE-2023-32162 | High | 7.8 | 2023-09-06 | Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2023-3915 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions… |
CVE-2023-34391 | High | 7.4 | 2023-08-31 | Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulatin… |
CVE-2023-40754 | High | 8.8 | 2023-08-28 | In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take… |
CVE-2023-4228 | Low | 3.1 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set pro… |
CVE-2023-20234 | Medium | 4.4 | 2023-08-23 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an a… |
CVE-2023-20230 | Medium | 5.4 | 2023-08-23 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2023-20200 | High | 7.7 | 2023-08-23 | A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliance… |
CVE-2023-4383 | High | 7.8 | 2023-08-16 | A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot… |
CVE-2023-4332 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file |
CVE-2023-28658 | Medium | 6.7 | 2023-08-11 | Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-39005 | High | 7.5 | 2023-08-09 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. |
CVE-2023-39004 | Critical | 9.8 | 2023-08-09 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to ac… |
CVE-2023-39003 | High | 7.5 | 2023-08-09 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. |
CVE-2022-39062 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for product folders. Thi… |
CVE-2023-38497 | High | 7.9 | 2023-08-04 | Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not res… |
CVE-2023-38991 | Medium | 5.4 | 2023-08-04 | An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Ad… |
CVE-2023-20216 | Medium | 4.4 | 2023-08-03 | A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileg… |
CVE-2023-3322 | High | 7.0 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-28133 | High | 7.8 | 2023-07-23 | Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file |
CVE-2023-35870 | Medium | 6.3 | 2023-07-11 | When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the sav… |
CVE-2023-33990 | High | 7.8 | 2023-07-11 | SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privil… |
CVE-2022-44719 | High | 7.5 | 2023-06-29 | An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions. |
CVE-2023-37237 | Medium | 6.5 | 2023-06-29 | In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary ope… |
CVE-2023-35800 | Medium | 4.3 | 2023-06-27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent… |
CVE-2023-35799 | Medium | 5.5 | 2023-06-27 | Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary f… |
CVE-2023-35168 | Medium | 6.5 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privileg… |
CVE-2023-29860 | High | 7.5 | 2023-06-23 | An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie metho… |
CVE-2023-34981 | High | 7.5 | 2023-06-21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP S… |
CVE-2023-26427 | Low | 3.2 | 2023-06-20 | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissi… |
CVE-2023-34154 | High | 8.2 | 2023-06-16 | Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windo… |
CVE-2023-34797 | Medium | 5.4 | 2023-06-15 | Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information. |
CVE-2023-34852 | Critical | 9.8 | 2023-06-15 | PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions. |
CVE-2023-21142 | Medium | 5.5 | 2023-06-15 | In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with n… |
CVE-2022-33163 | Medium | 5.3 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unint… |
CVE-2023-35147 | Medium | 6.5 | 2023-06-14 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with I… |
CVE-2023-31142 | Low | 2.0 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-33695 | High | 7.1 | 2023-06-13 | Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java. |
CVE-2023-31238 | Medium | 5.5 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P8… |
CVE-2023-30897 | High | 7.8 | 2023-06-13 | A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation… |
CVE-2023-2876 | Low | 3.1 | 2023-06-13 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware mod… |
CVE-2023-32114 | Low | 2.7 | 2023-06-13 | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privilege… |
CVE-2023-28399 | High | 7.8 | 2023-06-01 | Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriat… |
CVE-2023-28346 | High | 7.3 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed a… |
CVE-2022-41766 | Medium | 4.3 | 2023-05-29 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyro… |
CVE-2023-31874 | High | 8.8 | 2023-05-29 | Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process'). |
CVE-2023-31748 | High | 7.8 | 2023-05-24 | Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file. |
CVE-2023-31454 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31453 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-33251 | Medium | 4.7 | 2023-05-21 | When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions… |
CVE-2023-1692 | High | 7.5 | 2023-05-20 | The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-31871 | High | 7.8 | 2023-05-18 | OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software come… |
CVE-2023-33004 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. |
CVE-2023-32992 | High | 8.8 | 2023-05-16 | Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to… |
CVE-2023-32990 | Medium | 6.5 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-32986 | High | 8.8 | 2023-05-16 | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowin… |
CVE-2023-32979 | Medium | 4.3 | 2023-05-16 | Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to… |
CVE-2023-32303 | Medium | 5.2 | 2023-05-12 | Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the u… |
CVE-2023-28522 | Medium | 4.3 | 2023-05-12 | IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585. |
CVE-2023-31445 | Medium | 5.3 | 2023-05-11 | Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have… |
CVE-2022-46656 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation… |
CVE-2022-41771 | Medium | 6.5 | 2023-05-10 | Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentia… |
CVE-2022-41699 | High | 8.2 | 2023-05-10 | Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentia… |
CVE-2022-41658 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalati… |
CVE-2022-38103 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially en… |
CVE-2023-29092 | Low | 3.1 | 2023-05-09 | An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding of a wrong resource… |
CVE-2023-2478 | Critical | 9.6 | 2023-05-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all vers… |
CVE-2021-40331 | High | 8.1 | 2023-05-05 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database… |
CVE-2023-28068 | High | 7.3 | 2023-05-05 | Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authenticated malicious user can potentially expl… |
CVE-2023-30399 | High | 8.1 | 2023-05-04 | Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to a crafted update package link via a man… |
CVE-2023-25438 | High | 7.8 | 2023-05-04 | An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific fi… |
CVE-2023-0834 | High | 7.0 | 2023-04-28 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce… |