CWE-732 · Incorrect Permission Assignment for Critical Resource (page 9)
Page 9 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34112 | Medium | 6.5 | 2022-07-22 | An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved… |
CVE-2022-1655 | Medium | 6.5 | 2022-07-22 | An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOn… |
CVE-2022-34891 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |
CVE-2021-45492 | High | 7.8 | 2022-07-14 | In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH e… |
CVE-2022-20234 | High | 7.5 | 2022-07-13 | In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgT… |
CVE-2022-20218 | High | 7.8 | 2022-07-13 | In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic error in the code. This could lead to loca… |
CVE-2022-33695 | Medium | 5.1 | 2022-07-12 | Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the service. |
CVE-2021-38289 | High | 8.8 | 2022-07-12 | An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate informati… |
CVE-2022-30929 | High | 8.8 | 2022-07-06 | Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. |
CVE-2022-2227 | Low | 3.1 | 2022-07-01 | Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a… |
CVE-2014-0068 | Medium | 5.5 | 2022-06-30 | It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission. |
CVE-2022-23725 | High | 7.7 | 2022-06-30 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. |
CVE-2022-34043 | High | 7.3 | 2022-06-29 | Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute… |
CVE-2021-38879 | Medium | 5.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTP… |
CVE-2021-20355 | Medium | 5.3 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTP… |
CVE-2022-34012 | Medium | 6.5 | 2022-06-23 | Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. |
CVE-2022-1596 | Medium | 6.5 | 2022-06-21 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an… |
CVE-2022-31464 | High | 7.8 | 2022-06-16 | Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path. |
CVE-2022-32155 | High | 7.5 | 2022-06-15 | In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but i… |
CVE-2022-31465 | High | 7.8 | 2022-06-14 | A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update… |
CVE-2021-40649 | Medium | 6.5 | 2022-06-14 | In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set. |
CVE-2022-33175 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is acc… |
CVE-2022-1412 | High | 7.5 | 2022-06-13 | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visi… |
CVE-2022-25151 | High | 7.5 | 2022-06-09 | Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set… |
CVE-2022-30700 | High | 7.8 | 2022-05-27 | An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated pr… |
CVE-2022-1348 | Medium | 6.5 | 2022-05-25 | A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrota… |
CVE-2022-30990 | High | 7.5 | 2022-05-18 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240… |
CVE-2022-25172 | Medium | 6.1 | 2022-05-12 | An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie miss… |
CVE-2022-23743 | High | 7.8 | 2022-05-11 | Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in th… |
CVE-2021-44167 | Medium | 6.8 | 2022-05-11 | An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and b… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2022-29263 | High | 7.8 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-26340 | Medium | 4.9 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2022-22521 | High | 7.3 | 2022-04-27 | In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An… |
CVE-2022-24886 | Low | 2.2 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification… |
CVE-2021-23055 | Medium | 6.5 | 2022-04-21 | On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingre… |
CVE-2022-24872 | High | 8.1 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal… |
CVE-2021-38483 | Medium | 6.0 | 2022-04-20 | The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileges access to overwrite the binary and m… |
CVE-2022-29527 | High | 7.0 | 2022-04-20 | Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges… |
CVE-2022-22960 | High | 7.8 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scrip… |
CVE-2022-23448 | High | 7.8 | 2022-04-12 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1)… |
CVE-2022-1316 | High | 8.8 | 2022-04-11 | Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation |
CVE-2022-0556 | High | 7.3 | 2022-04-11 | A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, whic… |
CVE-2021-36290 | Medium | 6.4 | 2022-04-08 | Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability… |
CVE-2022-22516 | High | 7.8 | 2022-04-07 | The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space. |
CVE-2022-26250 | High | 7.8 | 2022-04-06 | Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges. |
CVE-2022-26281 | High | 7.5 | 2022-04-05 | BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. |
CVE-2022-23869 | Medium | 6.5 | 2022-03-30 | In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through… |
CVE-2022-22941 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user co… |
CVE-2022-24769 | Medium | 5.9 | 2022-03-24 | Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 2… |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2022-24236 | Low | 3.5 | 2022-03-21 | An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts. |
CVE-2022-26247 | Medium | 5.9 | 2022-03-20 | TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the adminis… |
CVE-2022-26526 | High | 7.8 | 2022-03-17 | Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and pl… |
CVE-2022-21946 | Medium | 5.3 | 2022-03-16 | A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gai… |
CVE-2022-21819 | High | 7.6 | 2022-03-11 | NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access… |
CVE-2022-22148 | High | 7.8 | 2022-03-11 | 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions… |
CVE-2022-22141 | High | 7.8 | 2022-03-11 | 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTU… |
CVE-2021-42855 | High | 7.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a… |
CVE-2021-4199 | High | 7.8 | 2022-03-07 | Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Interne… |
CVE-2021-3631 | Medium | 6.3 | 2022-03-02 | A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled… |
CVE-2022-25010 | Critical | 9.1 | 2022-03-01 | The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system. |
CVE-2022-24327 | High | 7.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. |
CVE-2022-0247 | High | 7.5 | 2022-02-25 | An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they… |
CVE-2021-3557 | Medium | 6.5 | 2022-02-16 | A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unp… |
CVE-2022-0483 | High | 7.8 | 2022-02-11 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53 |
CVE-2021-44521 | Critical | 9.1 | 2022-02-11 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_de… |
CVE-2022-0532 | Medium | 4.2 | 2022-02-09 | An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will b… |
CVE-2021-39992 | High | 7.8 | 2022-02-09 | There is an improper security permission configuration vulnerability on ACPU.Successful exploitation of this vulnerability may affect service confidentiality… |
CVE-2021-22284 | High | 8.4 | 2022-02-04 | Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running… |
CVE-2021-29396 | Critical | 9.8 | 2022-02-04 | Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities wi… |
CVE-2022-0338 | Medium | 4.3 | 2022-01-25 | Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. |
CVE-2022-0277 | Medium | 6.5 | 2022-01-20 | Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-21694 | Low | 3.7 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website m… |
CVE-2021-22566 | Critical | 9.8 | 2022-01-18 | An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T… |
CVE-2021-39627 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2021-39621 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2021-44466 | High | 7.3 | 2021-12-30 | Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default install… |
CVE-2021-20172 | High | 7.8 | 2021-12-30 | All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear G… |
CVE-2021-20874 | High | 7.5 | 2021-12-24 | Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlie… |
CVE-2021-27445 | High | 7.8 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device. |
CVE-2021-35248 | Medium | 6.8 | 2021-12-20 | It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. |
CVE-2021-0904 | Medium | 6.7 | 2021-12-15 | In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution… |
CVE-2021-42309 | High | 8.8 | 2021-12-15 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-43065 | High | 7.8 | 2021-12-09 | A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to… |
CVE-2021-36133 | High | 7.1 | 2021-12-07 | The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure Wo… |
CVE-2021-44512 | High | 7.0 | 2021-12-07 | World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handlin… |
CVE-2021-43034 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apa… |
CVE-2021-43359 | High | 8.8 | 2021-12-01 | Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general us… |
CVE-2021-40101 | High | 7.2 | 2021-11-30 | An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password. |
CVE-2021-44230 | Medium | 6.5 | 2021-11-30 | PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escal… |
CVE-2021-43998 | Medium | 6.5 | 2021-11-30 | HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity a… |
CVE-2021-42115 | High | 8.1 | 2021-11-30 | Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attac… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2021-43019 | High | 7.8 | 2021-11-23 | Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An una… |
CVE-2021-39235 | Medium | 6.5 | 2021-11-19 | In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do… |
CVE-2021-0064 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to p… |
CVE-2021-33094 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authen… |