Filtered by CWE-732
Filtered by vendor Subscriptions
Total 1713 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-40516 1 Lg 1 Simple Editor 2025-04-10 7.8 High
LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of LG Simple Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The product sets incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20327.
CVE-2022-47927 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2025-04-08 5.5 Medium
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
CVE-2022-4365 1 Gitlab 1 Gitlab 2025-04-08 5.5 Medium
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.
CVE-2022-39186 1 Exfo 2 Bv-10, Bv-10 Firmware 2025-04-08 6.2 Medium
EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
CVE-2023-27084 1 Iteachyou 1 Dreamer Cms 2025-04-04 5.3 Medium
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
CVE-2022-34457 1 Dell 1 Command\|configure 2025-04-03 7.3 High
Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non-admin to modify the files inside installed directory and able to make application unavailable for all users.
CVE-2023-22592 2 Ibm, Redhat 2 Robotic Process Automation For Cloud Pak, Openshift 2025-04-03 4 Medium
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073.
CVE-2023-20923 1 Google 1 Android 2025-04-02 5.5 Medium
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246933910References: N/A
CVE-2021-22117 2 Broadcom, Microsoft 2 Rabbitmq Server, Windows 2025-04-02 7.8 High
RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.
CVE-2022-44263 1 Dentsplysirona 1 Sidexis 2025-03-31 7.8 High
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
CVE-2024-30413 1 Huawei 2 Emui, Harmonyos 2025-03-28 7.5 High
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
CVE-2023-52715 1 Huawei 1 Harmonyos 2025-03-28 7.5 High
The SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2022-44715 1 Netscout 1 Ngeniusone 2025-03-28 8.8 High
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
CVE-2024-12151 1 Devolutions 1 Devolutions Server 2025-03-28 5 Medium
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-12149 1 Devolutions 1 Remote Desktop Manager 2025-03-28 8.1 High
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.
CVE-2021-37306 1 Jeecg 1 Jeecg 2025-03-26 7.5 High
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin.
CVE-2021-37305 1 Jeecg 1 Jeecg 2025-03-26 7.5 High
An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
CVE-2021-37304 1 Jeecg 1 Jeecg 2025-03-26 7.5 High
An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
CVE-2023-22326 1 F5 12 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 9 more 2025-03-26 4.9 Medium
In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2024-51448 1 Ibm 1 Robotic Process Automation 2025-03-25 6.7 Medium
IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service. A subsequent service or server restart will then run that binary with administrator privilege.