CWE-732 · Incorrect Permission Assignment for Critical Resource (page 9)
Page 9 of 18 — CVEs classified under CWE-732, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26526 | High | 7.8 | 2022-03-17 | Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and pl… |
CVE-2022-21946 | Medium | 5.3 | 2022-03-16 | A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gai… |
CVE-2022-21819 | High | 7.6 | 2022-03-11 | NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access… |
CVE-2022-22148 | High | 7.8 | 2022-03-11 | 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions… |
CVE-2022-22141 | High | 7.8 | 2022-03-11 | 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTU… |
CVE-2021-42855 | High | 7.8 | 2022-03-10 | It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a… |
CVE-2021-4199 | High | 7.8 | 2022-03-07 | Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Interne… |
CVE-2021-3631 | Medium | 6.3 | 2022-03-02 | A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled… |
CVE-2022-25010 | Critical | 9.1 | 2022-03-01 | The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system. |
CVE-2022-24327 | High | 7.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. |
CVE-2022-0247 | High | 7.5 | 2022-02-25 | An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they… |
CVE-2021-3557 | Medium | 6.5 | 2022-02-16 | A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unp… |
CVE-2022-0483 | High | 7.8 | 2022-02-11 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53 |
CVE-2021-44521 | Critical | 9.1 | 2022-02-11 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_de… |
CVE-2022-0532 | Medium | 4.2 | 2022-02-09 | An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will b… |
CVE-2021-39992 | High | 7.8 | 2022-02-09 | There is an improper security permission configuration vulnerability on ACPU.Successful exploitation of this vulnerability may affect service confidentiality… |
CVE-2021-22284 | High | 8.4 | 2022-02-04 | Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running… |
CVE-2021-29396 | Critical | 9.8 | 2022-02-04 | Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities wi… |
CVE-2022-0338 | Medium | 4.3 | 2022-01-25 | Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. |
CVE-2022-0277 | Medium | 6.5 | 2022-01-20 | Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-21694 | Low | 3.7 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website m… |
CVE-2021-22566 | Critical | 9.8 | 2022-01-18 | An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T… |
CVE-2021-39627 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2021-39621 | High | 7.8 | 2022-01-14 | In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2021-44466 | High | 7.3 | 2021-12-30 | Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default install… |
CVE-2021-20172 | High | 7.8 | 2021-12-30 | All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear G… |
CVE-2021-20874 | High | 7.5 | 2021-12-24 | Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlie… |
CVE-2021-27445 | High | 7.8 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device. |
CVE-2021-35248 | Medium | 6.8 | 2021-12-20 | It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. |
CVE-2021-0904 | Medium | 6.7 | 2021-12-15 | In SRAMROM, there is a possible permission bypass due to an insecure permission setting. This could lead to local escalation of privilege with System execution… |
CVE-2021-42309 | High | 8.8 | 2021-12-15 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2021-43065 | High | 7.8 | 2021-12-09 | A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to… |
CVE-2021-36133 | High | 7.1 | 2021-12-07 | The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure Wo… |
CVE-2021-44512 | High | 7.0 | 2021-12-07 | World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handlin… |
CVE-2021-43034 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apa… |
CVE-2021-43359 | High | 8.8 | 2021-12-01 | Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general us… |
CVE-2021-40101 | High | 7.2 | 2021-11-30 | An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password. |
CVE-2021-44230 | Medium | 6.5 | 2021-11-30 | PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escal… |
CVE-2021-43998 | Medium | 6.5 | 2021-11-30 | HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity a… |
CVE-2021-42115 | High | 8.1 | 2021-11-30 | Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attac… |
CVE-2021-24703 | Medium | 5.7 | 2021-11-23 | The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated… |
CVE-2021-43019 | High | 7.8 | 2021-11-23 | Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An una… |
CVE-2021-39235 | Medium | 6.5 | 2021-11-19 | In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do… |
CVE-2021-0064 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to p… |
CVE-2021-33094 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authen… |
CVE-2021-33093 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticat… |
CVE-2021-33091 | High | 7.8 | 2021-11-17 | Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to pot… |
CVE-2021-42955 | High | 7.3 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the de… |
CVE-2021-42954 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable… |
CVE-2020-4146 | Medium | 5.3 | 2021-11-12 | IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker cou… |
CVE-2021-37207 | High | 7.8 | 2021-11-09 | A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder con… |
CVE-2021-41170 | Critical | 9.8 | 2021-11-08 | neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a… |
CVE-2021-20526 | Medium | 5.3 | 2021-10-27 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker cou… |
CVE-2021-41589 | Critical | 9.8 | 2021-10-27 | In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the… |
CVE-2021-37364 | High | 7.8 | 2021-10-26 | OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A l… |
CVE-2021-40343 | High | 7.8 | 2021-10-26 | An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the… |
CVE-2021-38475 | High | 7.3 | 2021-10-22 | The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissions. |
CVE-2020-14263 | Low | 3.9 | 2021-10-21 | "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" |
CVE-2021-31377 | Medium | 5.5 | 2021-10-19 | An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to… |
CVE-2021-26589 | Medium | 6.1 | 2021-10-19 | A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripti… |
CVE-2021-41802 | Low | 2.9 | 2021-10-08 | HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another u… |
CVE-2021-34758 | Medium | 4.4 | 2021-10-06 | A vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, loc… |
CVE-2021-20264 | High | 7.8 | 2021-10-06 | An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the c… |
CVE-2021-0692 | High | 7.8 | 2021-10-06 | In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalati… |
CVE-2021-41091 | Medium | 6.3 | 2021-10-04 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typical… |
CVE-2021-39868 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modif… |
CVE-2021-3747 | High | 8.8 | 2021-10-01 | The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. |
CVE-2021-35202 | Medium | 4.3 | 2021-09-30 | NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService. |
CVE-2021-34410 | High | 7.8 | 2021-09-27 | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows f… |
CVE-2021-34409 | High | 7.8 | 2021-09-27 | It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom… |
CVE-2021-40067 | Medium | 6.8 | 2021-09-16 | The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled… |
CVE-2021-40066 | Medium | 5.3 | 2021-09-16 | The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credenti… |
CVE-2021-39210 | Medium | 6.5 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remem… |
CVE-2021-26434 | High | 7.8 | 2021-09-15 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2021-22149 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using… |
CVE-2021-22148 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This… |
CVE-2021-22147 | Medium | 6.5 | 2021-09-15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to… |
CVE-2021-3706 | High | 7.5 | 2021-09-15 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag |
CVE-2021-35508 | High | 8.8 | 2021-09-01 | NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exp… |
CVE-2020-18121 | High | 8.8 | 2021-08-30 | A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. |
CVE-2021-38154 | High | 7.5 | 2021-08-29 | Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remot… |
CVE-2021-30964 | Medium | 5.5 | 2021-08-24 | An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A… |
CVE-2021-30920 | Medium | 5.5 | 2021-08-24 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive inform… |
CVE-2021-30892 | Medium | 5.5 | 2021-08-24 | An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, mac… |
CVE-2021-38557 | High | 8.8 | 2021-08-24 | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/r… |
CVE-2021-25263 | High | 7.8 | 2021-08-17 | Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYST… |
CVE-2021-36281 | High | 7.5 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially… |
CVE-2021-36280 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-36279 | High | 7.8 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with I… |
CVE-2021-37841 | High | 7.8 | 2021-08-12 | Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it… |
CVE-2021-38590 | Medium | 5.5 | 2021-08-11 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). |
CVE-2017-16631 | Medium | 6.5 | 2021-08-11 | In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Reference (IDOR) in the "Ac… |
CVE-2017-16630 | High | 8.8 | 2021-08-11 | In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object… |
CVE-2021-38085 | High | 7.8 | 2021-08-11 | The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CN… |
CVE-2021-21567 | High | 7.8 | 2021-08-10 | Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PR… |
CVE-2021-32577 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. |
CVE-2021-30577 | High | 7.8 | 2021-08-03 | Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a craf… |
CVE-2021-32463 | High | 7.8 | 2021-07-20 | An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Business Security 10.0 SP1… |