Filtered by CWE-732
Filtered by vendor Subscriptions
Total 1411 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-7958 3 Adobe, Apple, Microsoft 3 Creative Cloud, Mac Os X, Windows 2024-11-21 N/A
Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-7729 1 Bosch 1 Smart Camera 2024-11-21 N/A
An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. (The Bosch Smart Home App is not affected. iOS Apps are not affected.)
CVE-2019-7656 1 Wowza 1 Streaming Engine 2024-11-21 7.8 High
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5.
CVE-2019-6465 2 Isc, Redhat 2 Bind, Enterprise Linux 2024-11-21 5.3 Medium
Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.
CVE-2019-5642 1 Rapid7 1 Metasploit 2024-11-21 3.3 Low
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.
CVE-2019-5543 2 Microsoft, Vmware 4 Windows, Horizon Client, Remote Console and 1 more 2024-11-21 7.8 High
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.
CVE-2019-5222 1 Huawei 2 Honor Magic 2, Honor Magic 2 Firmware 2024-11-21 N/A
There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The Secure Input does not properly limit certain system privilege. An attacker tricks the user to install a malicious application and successful exploit could result in information disclosure.
CVE-2019-5212 1 Huawei 2 P20, P20 Firmware 2024-11-21 5.5 Medium
There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share, successful exploit could cause information disclosure.
CVE-2019-5068 4 Canonical, Debian, Mesa3d and 1 more 4 Ubuntu Linux, Debian Linux, Mesa and 1 more 2024-11-21 4.4 Medium
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.
CVE-2019-4702 1 Ibm 1 Security Guardium Data Encrpytion 2024-11-21 8.1 High
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVE-2019-4603 1 Ibm 1 Rational Quality Manager 2024-11-21 4.3 Medium
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
CVE-2019-4214 1 Ibm 1 Smartcloud Analytics Log Analysis 2024-11-21 3.7 Low
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
CVE-2019-4093 2 Ibm, Microsoft 2 Spectrum Protect, Windows 2024-11-21 4.4 Medium
IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interface on Windows that they should not have access to due to incorrect file permissions. IBM X-Force ID: 157981.
CVE-2019-4078 1 Ibm 1 Websphere Mq 2024-11-21 7.8 High
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190.
CVE-2019-3893 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-11-21 4.9 Medium
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
CVE-2019-3866 1 Redhat 3 Openstack, Openstack-mistral, Quay 2024-11-21 5.5 Medium
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.
CVE-2019-3765 1 Dell 2 Emc Avamar Server, Emc Integrated Data Protection Appliance 2024-11-21 8.1 High
Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could exploit this vulnerability to view or modify sensitive backup data. This could be used to make backups corrupt or potentially to trick a user into restoring a backup with malicious files in place.
CVE-2019-3683 2 Hp, Suse 3 Helion Openstack, Keystone-json-assignment, Openstack Cloud 2024-11-21 8.8 High
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.
CVE-2019-3467 3 Canonical, Debian, Skolelinux 4 Ubuntu Linux, Debian-lan-config, Debian Linux and 1 more 2024-11-21 7.8 High
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
CVE-2019-3425 1 Zte 2 Zxupn-9000e, Zxupn-9000e Firmware 2024-11-21 8.8 High
The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts.