cve.bz

CWE-732: Incorrect Permission Assignment for Critical Resource, page 11

Filter

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

What the weakness is: CWE-732 at MITRE

Ask an AI about CWE-732

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-732: Incorrect Permission Assignment for Critical Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/732.html and https://cve.bz/cve/cwe/732?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2024-12149EPSS 0.6%

    Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more priv…

  2. 8.2CVE-2024-37574EPSS 0.4%

    The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivi…

  3. 7.1CVE-2024-42449EPSS 6.0%

    From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.

  4. 4.1CVE-2024-54159EPSS 0.2%

    stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.

  5. 6.4CVE-2024-21703EPSS 0.2%

    This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows a…

  6. 5.9CVE-2024-28955EPSS 1.3%

    Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, …

  7. 7.8CVE-2024-9245EPSS 0.3%

    Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must firs…

  8. 7.8CVE-2024-9244EPSS 0.3%

    Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must firs…

  9. 7.8CVE-2024-7245EPSS 0.2%

    Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obt…

  10. 7.8CVE-2024-6871EPSS 0.2%

    G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obt…

  11. 8.4CVE-2024-38646EPSS 0.2%

    An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or m…

  12. 5.3CVE-2024-11176EPSS 0.4%

    Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.

  13. 7.1CVE-2024-41974EPSS 0.4%

    A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.

  14. 5.7CVE-2024-41970EPSS 0.4%

    A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.

  15. 5.4CVE-2024-36294EPSS 0.1%

    Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.

  16. 5.4CVE-2024-36276EPSS 0.1%

    Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of privilege via local access.

  17. 7.8CVE-2024-39709EPSS 0.3%

    Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

  18. 3.3CVE-2024-9842EPSS 0.2%

    Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.

  19. 8.3CVE-2024-47808EPSS 0.1%

    A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restrict the permissions of users to write to the filesystem of the host system. Thi…

  20. 8.5CVE-2024-47783EPSS 0.1%

    A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or m…

  21. 7.8CVE-2024-50590EPSS 0.2%

    Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory o…

  22. 8.6CVE-2024-10526EPSS 0.2%

    Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to…

  23. 7.1CVE-2024-45164EPSS 0.3%

    Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admi…

  24. 3.3CVE-2024-10228EPSS 0.1%

    The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228…

  25. 7.1CVE-2024-0128EPSS 0.2%

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and es…

  26. 7.5CVE-2022-30354EPSS 0.5%

    OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers.

  27. 3.8CVE-2024-46897EPSS 0.4%

    Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permission of table management may obtain and/or alter the information of the unautho…

  28. 7.3CVE-2023-6729EPSS 0.1%

    Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configu…

  29. 7.8CVE-2024-22029EPSS 0.2%

    Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

  30. 9.8CVE-2024-10018EPSS 0.5%

    Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.

  31. 7.5CVE-2024-44729EPSS 0.7%

    Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to arbitrarily eject users from a meeting.

  32. 6.3CVE-2024-47833EPSS 0.3%

    Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been …

  33. 7.8CVE-2024-7612EPSS 0.2%

    Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.

  34. 9.8CVE-2024-24117EPSS 0.7%

    Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component.

  35. 6.9CVE-2024-6360EPSS 0.3%

    Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.…

  36. 8.8CVE-2024-7594EPSS 0.3%

    Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an aut…

  37. 9.4CVE-2024-9142EPSS 0.4%

    External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye: before 2.0…

  38. 7.5CVE-2022-43845EPSS 0.4%

    IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from t…

  39. 7.5CVE-2024-8900EPSS 0.4%

    An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129, Firefox ESR < 128.3, and Thunderbird < 128.3.

  40. 9.8CVE-2024-8039EPSS 0.4%

    Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks.

  41. 7.8CVE-2024-6510EPSS 0.1%

    Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.

  42. 3.7CVE-2024-44575EPSS 0.3%

    RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

  43. 9.3CVE-2024-41171EPSS 0.1%

    A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access r…

  44. 8.8CVE-2024-45041EPSS 0.6%

    External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This…

  45. 7.8CVE-2024-38456EPSS 0.2%

    HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in prunsrv.exe. A regular user (non-admin) can exploit the weak folder and file permissi…

  46. 5.5CVE-2023-49582EPSS 0.3%

    Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platf…

  47. 8.1CVE-2022-43915EPSS 0.4%

    IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with p…

  48. 6.8CVE-2024-7986EPSS 0.6%

    A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary file…

  49. 7.8CVE-2024-5930EPSS 0.3%

    VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first…

  50. 8.5CVE-2024-7513EPSS 1.7%

    CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated …