CVE-2023-42489
7.5HIGH
EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource
EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource
10/25/2023CWE-732
Schwachstellentyp
CWE-732
Alle CVE-Schwachstellen, die unter diesen Schwachstellentyp fallen.
Auf MITRE CWE ansehenGesamt CVEs
50
Kritisch
2
In KEV
0
Mit Exploits
0
CVE-2024-31202
7.8HIGH
A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.
A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.
7/31/2024CWE-732, CWE-732
CVE-2021-22716
7.8HIGH
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies a file. Affected Product: C-Bus Toolkit
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies a file. Affected Product: C-Bus Toolkit ...
4/13/2021CWE-732, CWE-732
CVE-2022-43946
7.5HIGH
Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in F
Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in F...
4/11/2023CWE-732, CWE-367 +1
CVE-2022-42949
7.5HIGH
Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.
Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.
12/21/2022CWE-732, CWE-732
CVE-2022-44263
7.8HIGH
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
1/26/2023CWE-732, CWE-732
CVE-2019-5642
3.3LOW
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permi
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permi...
11/6/2019CWE-732, CWE-732
CVE-2025-54546
7.5HIGH
On affected platforms, restricted users could use SSH port forwarding to access host-internal services
On affected platforms, restricted users could use SSH port forwarding to access host-internal services
10/29/2025CWE-732, CWE-732
CVE-2023-32723
8.5HIGH
Request to LDAP is sent before user permissions are checked.
Request to LDAP is sent before user permissions are checked.
10/12/2023CWE-732, CWE-732
CVE-2022-36122
7.8HIGH
The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
10/21/2022CWE-732, CWE-732
CVE-2023-0225
4.3MEDIUM
A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
4/3/2023CWE-732, CWE-732 +1
CVE-2022-0277
6.5MEDIUM
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
1/20/2022CWE-732, CWE-732
CVE-2022-39186
6.2MEDIUM
EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
1/12/2023CWE-732, CWE-732
CVE-2023-4332
7.5HIGH
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
8/15/2023CWE-732, CWE-732
CVE-2022-48257
5.3MEDIUM
In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
1/13/2023CWE-732, CWE-732
CVE-2022-3258
3.7LOW
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.
11/3/2022CWE-732, CWE-732
CVE-2023-28123
5.5MEDIUM
A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0
A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0...
4/19/2023CWE-732, CWE-732 +1
CVE-2023-28133
7.8HIGH
Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file
Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file
7/23/2023CWE-732, CWE-732
CVE-2025-57741
7.8HIGH
An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local attacker to run arbitra
An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local attacker to run arbitra...
10/14/2025CWE-732
CVE-2025-54545
7.8HIGH
On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
10/29/2025CWE-732, CWE-732
CVE-2023-31748
7.8HIGH
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.
5/24/2023CWE-732, CWE-732
CVE-2022-2332
6.2MEDIUM
A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
9/16/2022CWE-732, CWE-732
CVE-2022-1316
8.8HIGH
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
4/11/2022CWE-732, CWE-732
CVE-2023-22294
8.8HIGH
Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions.
Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions.
4/18/2023CWE-732, CWE-732
CVE-2022-45193
5.9MEDIUM
CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.
CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.
11/12/2022CWE-732, CWE-732
CVE-2022-33695
5.1MEDIUM
Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the service.
Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the service.
7/12/2022CWE-732, CWE-732
CVE-2022-44715
8.8HIGH
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
1/27/2023CWE-732, CWE-732
CVE-2024-7612
8.8HIGH
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
10/8/2024CWE-732, CWE-732
CVE-2023-1692
7.5HIGH
The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.
The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.
5/20/2023CWE-732, CWE-732
CVE-2023-27084
5.3MEDIUM
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
3/16/2023CWE-732, CWE-732
CVE-2023-31874
8.8HIGH
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
5/29/2023CWE-732, CWE-732
CVE-2023-33004
4.3MEDIUM
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
5/16/2023CWE-732, CWE-732
CVE-2023-25438
7.8HIGH
An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific files.
An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via modifying specific files.
5/4/2023CWE-732, CWE-732
CVE-2021-44167
6.8MEDIUM
An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauth
An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauth...
5/11/2022CWE-732
CVE-2024-12151
5.0MEDIUM
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
12/4/2024CWE-732, CWE-732
CVE-2023-32724
9.1CRITICAL
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.
10/12/2023CWE-732, CWE-732
CVE-2023-1135
7.8HIGH
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation.
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation....
3/27/2023CWE-732, CWE-732
CVE-2023-27095
6.5MEDIUM
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
3/16/2023CWE-732, CWE-732
CVE-2021-37304
7.5HIGH
An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
2/3/2023CWE-732, CWE-732
CVE-2014-0068
5.5MEDIUM
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
6/30/2022CWE-732, CWE-732
CVE-2019-18243
5.5MEDIUM
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
2/18/2021CWE-732, CWE-732
CVE-2019-18255
5.5MEDIUM
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.
2/18/2021CWE-732, CWE-732
CVE-2025-0758
6.1MEDIUM
Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Va
Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Va...
4/16/2025CWE-732
CVE-2022-1348
6.5MEDIUM
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock...
5/25/2022CWE-732, CWE-732 +1
CVE-2024-5915
7.8HIGH
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.
8/14/2024CWE-732, CWE-732
CVE-2024-37369
8.8HIGH
A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further acces
A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further acces...
6/14/2024CWE-732, CWE-732
CVE-2023-49257
8.8HIGH
An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.
An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.
1/12/2024CWE-732, CWE-732
CVE-2023-0834
7.0HIGH
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1.
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1.
4/28/2023CWE-732, CWE-732
CVE-2023-24205
9.8CRITICAL
Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).
Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).
2/23/2023CWE-732, CWE-732
CVE-2022-35250
4.3MEDIUM
A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions.
A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions.
9/23/2022CWE-732, CWE-732
Zeige 50 von many CVEs