CWE-732 · Access Control
Incorrect Permission Assignment for Critical Resource
1,585CVEs
3exploited
7with a public check
17likely (EPSS 10%+)
SortMost likely exploited
1,585 CVEs with CWE-732 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-15752In CISA KEVExploitedDocker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\v…Docker · Desktop Community Edition · CVSS 7.8 · 2019-08-28 | 7.8 | 49% | 2019-08-28 |
| CVE-2018-13374In CISA KEVExploitedA Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials c…Fortinet · Fortinet FortiOS, fortiADC · CVSS 4.3 · 2019-01-22 | 4.3 | 38% | 2019-01-22 |
| CVE-2022-22960In CISA KEVExploitedVMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious acto…VMware · VMware Workspace ONE Access, Identity Manager and vRealize Automation · CVSS 7.8 · 2022-04-13 | 7.8 | 36% | 2022-04-13 |
| CVE-2018-14916CheckLoytec LGATE-902 <6.4.2 - Local File InclusionLoytec · Lgate-902 Firmware · 2019-06-28 | – | 17% | 2019-06-28 |
| CVE-2018-1000226CheckCobbler - Authentication BypassCobblerd · Cobbler · 2018-08-20 | – | 13% | 2018-08-20 |
| CVE-2018-12296CheckSeagate NAS OS 4.3.15.1 - Server Information DisclosureSeagate · Nas Os · 2019-05-13 | – | 11% | 2019-05-13 |
| CVE-2021-37304CheckJeecg Boot <= 2.4.5 - Information DisclosureJeecg · Jeecg · CVSS 7.5 · 2023-02-03 | 7.5 | 4.0% | 2023-02-03 |
| CVE-2021-38154CheckCanon Devices - Authentication Bypass in Catwalk ServerCanon · 2021-08-29 | – | 4.0% | 2021-08-29 |
| CVE-2021-37305CheckJeecg Boot <= 2.4.5 - Sensitive Information DisclosureJeecg · Jeecg · CVSS 7.5 · 2023-02-03 | 7.5 | 3.5% | 2023-02-03 |
| CVE-2026-63358CheckFileGator < 7.14.2 - Privilege EscalationFileGator · FileGator · CVSS 7.3 · 2026-07-21 | 7.3 | 0.5% | 2026-07-21 |
| CVE-2011-3923Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.Apache · Struts · 2019-11-01 | – | 89% | 2019-11-01 |
| CVE-2018-1000207MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating…Modx · Modx Revolution · 2018-07-13 | – | 64% | 2018-07-13 |
| CVE-2023-32986Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Ite…Jenkins Project · Jenkins File Parameter Plugin · CVSS 8.8 · 2023-05-16 | 8.8 | 61% | 2023-05-16 |
| CVE-2017-16885Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passwords, etc.) allows r…Fiberhome · Lm53q1 Firmware · 2018-01-12 | – | 33% | 2018-01-12 |
| CVE-2010-0488Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and o…Microsoft · Internet Explorer · CVSS 6.5 · 2010-03-31 | 6.5 | 29% | 2010-03-31 |
| CVE-2018-4072An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Tas…Sierrawireless · Sierra Wireless · 2019-05-06 | – | 26% | 2019-05-06 |
| CVE-2020-0668An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID…Microsoft · Windows · 2020-02-11 | – | 26% | 2020-02-11 |
| CVE-2018-4073An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the end…Sierrawireless · Sierra Wireless · 2019-05-06 | – | 26% | 2019-05-06 |
| CVE-2020-11107An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini f…Apachefriends · Xampp · 2020-04-02 | – | 22% | 2020-04-02 |
| CVE-2022-43773Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical ResourceHitachi Vantara · Pentaho Business Analytics Server · CVSS 8.8 · 2023-04-03 | 8.8 | 22% | 2023-04-03 |
| CVE-2017-9462In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a re…Mercurial · Mercurial · 2017-06-06 | – | 22% | 2017-06-06 |
| CVE-2026-21902Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as rootJuniper Networks · Junos OS Evolved · CVSS 9.8 · 2026-02-25 | 9.8 | 18% | 2026-02-25 |
| CVE-2021-21177Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a…Google · Chrome · 2021-03-09 | – | 17% | 2021-03-09 |
| CVE-2018-10285The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authenticatio…Ericssonlg · Ipecs Nms · 2018-04-22 | – | 13% | 2018-04-22 |
| CVE-2017-17867Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify…Intenogroup · Iopsys · 2018-01-04 | – | 11% | 2018-01-04 |
| CVE-2017-3006Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative Cloud desktop applications.Adobe · Adobe Thor 3.9.5.353 and earlier. · 2017-04-12 | – | 11% | 2017-04-12 |
| CVE-2021-30892An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A…Apple · macOS · 2021-08-24 | – | 10% | 2021-08-24 |
| CVE-2018-15768Insecure MySQL Configuration VulnerabilityDell · OpenManage Network Manager · 2018-11-30 | – | 9.1% | 2018-11-30 |
| CVE-2018-12979An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by…Wago · 762-3000 Firmware · 2018-07-12 | – | 7.8% | 2018-07-12 |
| CVE-2021-22921Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configur…NodeJS · Node · 2021-07-12 | – | 7.4% | 2021-07-12 |
| CVE-2020-28909Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files th…Nagios · Fusion · 2021-05-24 | – | 6.7% | 2021-05-24 |
| CVE-2021-31475This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to explo…SolarWinds · Orion Job Scheduler · CVSS 8.8 · 2021-05-21 | 8.8 | 6.5% | 2021-05-21 |
| CVE-2018-13110All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerability where attackers can gain access to the command line inter…Adbglobal · Dv2210 Firmware · 2018-07-06 | – | 6.3% | 2018-07-06 |
| CVE-2024-42449From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.Veeam · Service Provider Console · CVSS 7.1 · 2024-12-04 | 7.1 | 6.0% | 2024-12-04 |
| CVE-2023-28133Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration fileCheckpoint · Harmony Endpoint. · 2023-07-23 | – | 5.7% | 2023-07-23 |
| CVE-2017-8857In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.Veritas · Netbackup · 2017-05-09 | – | 5.7% | 2017-05-09 |
| CVE-2020-15910SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could…Solarwinds · N-Central · 2020-10-19 | – | 5.6% | 2020-10-19 |
| CVE-2020-10883This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain…TP-Link · Archer A7 · CVSS 5.3 · 2020-03-25 | 5.3 | 5.3% | 2020-03-25 |
| CVE-2019-0804An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.Microsoft · Azure · 2019-04-09 | – | 5.2% | 2019-04-09 |
| CVE-2020-28910Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getpro…Nagios · Nagios Xi · 2021-05-24 | – | 5.1% | 2021-05-24 |
| CVE-2023-2478An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 1…GitLab · GitLab · CVSS 9.6 · 2023-05-08 | 9.6 | 5.0% | 2023-05-08 |
| CVE-2023-31874Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').Yank-Note · Yank Note · CVSS 8.8 · 2023-05-28 | 8.8 | 4.9% | 2023-05-28 |
| CVE-2019-0588An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange…Microsoft · Microsoft Exchange Server · 2019-01-08 | – | 4.6% | 2019-01-08 |
| CVE-2026-24291Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-03-10 | 7.8 | 4.6% | 2026-03-10 |
| CVE-2019-12876Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to…Zohocorp · Manageengine Admanager Plus · 2019-07-17 | – | 4.6% | 2019-07-17 |
| CVE-2019-19363An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions…Ricoh · Generic Pcl5 Driver · 2020-01-24 | – | 4.4% | 2020-01-24 |
| CVE-2018-14327The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Contr…Ee · Ee40vb Firmware · 2018-09-26 | – | 4.4% | 2018-09-26 |
| CVE-2019-7958Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privilege escalation.Adobe · Creative Cloud Desktop Application · 2019-08-16 | – | 4.4% | 2019-08-16 |
| CVE-2017-8665The Xamarin.iOS update component on systems running macOS allows an attacker to run arbitrary code as root, aka "Xamarin.iOS Elevation Of Privilege Vulnerability."Microsoft Corporation · Xamarin.iOS · 2017-08-15 | – | 4.3% | 2017-08-15 |
| CVE-2017-9602KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the f…Kbvault Mysql Project · Kbvault Mysql · 2017-06-16 | – | 4.3% | 2017-06-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.