CWE-732 · Incorrect Permission Assignment for Critical Resource (page 8)
Page 8 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0207 | High | 7.5 | 2023-04-22 | NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful e… |
CVE-2023-28123 | Medium | 5.5 | 2023-04-19 | A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting… |
CVE-2023-30606 | Medium | 4.2 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSe… |
CVE-2023-22294 | High | 8.8 | 2023-04-18 | Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. |
CVE-2023-28960 | High | 8.2 | 2023-04-17 | An Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved allows a local, authenticated low-privileged attack… |
CVE-2023-30512 | Medium | 6.5 | 2023-04-12 | CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets… |
CVE-2023-1939 | Medium | 4.3 | 2023-04-11 | No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager L… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2023-24626 | Medium | 6.5 | 2023-04-08 | socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a p… |
CVE-2022-43309 | Medium | 5.5 | 2023-04-07 | Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. |
CVE-2023-0944 | Medium | 4.3 | 2023-04-05 | Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password… |
CVE-2023-0225 | Medium | 4.3 | 2023-04-03 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any ob… |
CVE-2022-43773 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configu… |
CVE-2023-1516 | High | 7.9 | 2023-03-28 | RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a local user to escalate p… |
CVE-2023-25817 | Low | 3.5 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete… |
CVE-2023-1135 | High | 7.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which co… |
CVE-2023-27096 | Medium | 6.5 | 2023-03-27 | Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function o… |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2023-27095 | Medium | 6.5 | 2023-03-16 | Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController functi… |
CVE-2023-27084 | Medium | 5.3 | 2023-03-16 | Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter. |
CVE-2023-23939 | Low | 3.9 | 2023-03-06 | Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a f… |
CVE-2023-24205 | Critical | 9.8 | 2023-02-23 | Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw… |
CVE-2021-3172 | High | 8.1 | 2023-02-17 | An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. |
CVE-2022-25992 | High | 7.5 | 2023-02-16 | Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2023-25150 | Medium | 5.8 | 2023-02-08 | Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide ac… |
CVE-2021-37306 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: a… |
CVE-2021-37305 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /… |
CVE-2021-37304 | High | 7.5 | 2023-02-03 | An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the ht… |
CVE-2023-22326 | Medium | 4.9 | 2023-02-01 | In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions… |
CVE-2022-42972 | High | 7.8 | 2023-02-01 | A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifie… |
CVE-2022-44715 | High | 8.8 | 2023-01-27 | Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload. |
CVE-2022-44263 | High | 7.8 | 2023-01-26 | Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control. |
CVE-2023-23610 | Medium | 6.5 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having a… |
CVE-2023-20923 | Medium | 5.5 | 2023-01-26 | In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead… |
CVE-2023-22592 | Medium | 4.0 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission set… |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2022-48257 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp. |
CVE-2022-39186 | Medium | 6.2 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions |
CVE-2022-47927 | Medium | 5.5 | 2023-01-12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data dir… |
CVE-2022-4365 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4630 | Medium | 5.3 | 2022-12-21 | Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. |
CVE-2022-42949 | High | 7.5 | 2022-12-21 | Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. |
CVE-2022-43517 | High | 7.8 | 2022-12-13 | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306). The affected application improperly assigns file permissions to installation… |
CVE-2022-23143 | Medium | 6.5 | 2022-12-05 | ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use… |
CVE-2022-46338 | Medium | 6.5 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowin… |
CVE-2022-45307 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\… |
CVE-2022-45306 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the… |
CVE-2022-45305 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Py… |
CVE-2022-45304 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmd… |
CVE-2022-45301 | Medium | 4.3 | 2022-11-29 | Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\rub… |
CVE-2022-41926 | Low | 3.3 | 2022-11-25 | Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermi… |
CVE-2022-44725 | High | 7.8 | 2022-11-17 | OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a mal… |
CVE-2022-34314 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450. |
CVE-2022-45193 | Medium | 5.9 | 2022-11-12 | CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation. |
CVE-2022-44746 | Medium | 5.5 | 2022-11-07 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2022-44733 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-44732 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-2188 | Medium | 6.5 | 2022-11-07 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory con… |
CVE-2022-3258 | Low | 3.7 | 2022-11-03 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. |
CVE-2022-32929 | Medium | 5.5 | 2022-11-01 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 15.7 and iPadOS 15.7, iOS 16.1 and iPa… |
CVE-2022-36122 | High | 7.8 | 2022-10-21 | The Automox Agent before 40 on Windows incorrectly sets permissions on key files. |
CVE-2022-22248 | High | 7.3 | 2022-10-18 | An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the cont… |
CVE-2022-26238 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ov… |
CVE-2022-26236 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged us… |
CVE-2022-39284 | Low | 2.6 | 2022-10-06 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected… |
CVE-2022-2975 | High | 7.7 | 2022-10-06 | A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modi… |
CVE-2022-26240 | Medium | 6.5 | 2022-10-06 | The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-26239 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to over… |
CVE-2022-26237 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-40756 | High | 8.8 | 2022-09-30 | If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Upd… |
CVE-2022-23726 | Medium | 5.4 | 2022-09-30 | PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive e… |
CVE-2020-15329 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions. |
CVE-2020-15328 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions. |
CVE-2022-32169 | Medium | 4.3 | 2022-09-28 | The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues… |
CVE-2022-40817 | Medium | 4.3 | 2022-09-27 | Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some… |
CVE-2022-35250 | Medium | 4.3 | 2022-09-23 | A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages… |
CVE-2022-40298 | High | 8.8 | 2022-09-23 | Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Win… |
CVE-2022-28802 | Critical | 9.9 | 2022-09-21 | Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapie… |
CVE-2017-20148 | Critical | 9.8 | 2022-09-20 | In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because… |
CVE-2022-2995 | High | 7.1 | 2022-09-19 | Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an… |
CVE-2022-2332 | Medium | 6.2 | 2022-09-16 | A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment. |
CVE-2022-22330 | Medium | 5.3 | 2022-09-13 | IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could e… |
CVE-2022-20399 | Medium | 5.5 | 2022-09-13 | In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local informa… |
CVE-2022-20398 | High | 7.8 | 2022-09-13 | In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. This could lead to loca… |
CVE-2022-39207 | Medium | 5.4 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They c… |
CVE-2022-36103 | High | 7.2 | 2022-09-13 | Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improp… |
CVE-2022-37771 | Medium | 6.7 | 2022-09-06 | IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes wi… |
CVE-2022-36670 | Medium | 6.7 | 2022-09-06 | PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify p… |
CVE-2022-38170 | Medium | 4.7 | 2022-09-02 | In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in… |
CVE-2022-37435 | High | 8.8 | 2022-09-01 | Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affec… |
CVE-2022-32778 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32777 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2020-27836 | Critical | 9.8 | 2022-08-22 | A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access… |
CVE-2022-35167 | High | 8.8 | 2022-08-19 | Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions. |
CVE-2022-22411 | Medium | 6.5 | 2022-08-10 | IBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 could allow an authenticated user to insert code which could allow the attacker to manipulate cluster res… |
CVE-2020-1754 | Medium | 4.3 | 2022-08-05 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewi… |
CVE-2022-36800 | Medium | 4.3 | 2022-08-03 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via a… |
CVE-2021-22648 | High | 8.8 | 2022-07-28 | Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file. |