Filtered by CWE-732
Filtered by vendor Subscriptions
Total 1529 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-31377 1 Juniper 1 Junos 2024-11-21 5.5 Medium
An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to cause routing process daemon (RPD) to crash and restart, causing a Denial of Service (DoS). Repeated actions by the attacker will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R1-S1, 20.4R2.
CVE-2021-31167 1 Microsoft 9 Windows 10, Windows 10 1809, Windows 10 1909 and 6 more 2024-11-21 7.8 High
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2021-31155 1 Umask Project 1 Umask 2024-11-21 7.8 High
Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.
CVE-2021-30964 1 Apple 4 Ipados, Iphone Os, Macos and 1 more 2024-11-21 5.5 Medium
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences.
CVE-2021-30920 1 Apple 1 Macos 2024-11-21 5.5 Medium
A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive information.
CVE-2021-30892 1 Apple 2 Mac Os X, Macos 2024-11-21 5.5 Medium
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts of the file system.
CVE-2021-30577 2 Fedoraproject, Google 2 Fedora, Chrome 2024-11-21 7.8 High
Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file.
CVE-2021-29396 1 Globalnorthstar 1 Northstar Club Management 2024-11-21 9.8 Critical
Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.
CVE-2021-29247 1 Btcpayserver 1 Btcpay Server 2024-11-21 5.3 Medium
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.
CVE-2021-28646 1 Trendmicro 2 Apex One, Officescan 2024-11-21 5.5 Medium
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
CVE-2021-28645 1 Trendmicro 2 Apex One, Officescan 2024-11-21 7.8 High
An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2021-28374 1 Debian 2 Courier-authlib, Debian Linux 2024-11-21 7.5 High
The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids, home and/or Maildir directory, quota, and some type of password information (such as a hash).
CVE-2021-28269 1 Soyal 1 701client 2024-11-21 8.8 High
Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions.
CVE-2021-28098 1 Forescout 1 Counteract 2024-11-21 7.8 High
An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.
CVE-2021-27764 1 Hcltech 1 Bigfix Webui 2024-11-21 7.4 High
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
CVE-2021-27483 1 Zoll 1 Defibrillator Dashboard 2024-11-21 7.8 High
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user.
CVE-2021-27445 1 Mesalabs 1 Amegaview 2024-11-21 7.8 High
Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.
CVE-2021-27070 1 Microsoft 6 Windows 10, Windows 10 1809, Windows 10 20h2 and 3 more 2024-11-21 7.3 High
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-26589 1 Hpe 4 Superdome Flex, Superdome Flex 280, Superdome Flex 280 Firmware and 1 more 2024-11-21 6.1 Medium
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.
CVE-2021-26434 1 Microsoft 2 Visual Studio 2017, Visual Studio 2019 2024-11-21 7.8 High
Visual Studio Elevation of Privilege Vulnerability