CWE:

	Topic	Date	Author
High	Wordpress Plugin XCloner 4.2.12 Remote Code Execution (Authenticated)	07.07.2021	Ron Jost
High	WordPress XCloner 4.2.12 Remote Code Execution	02.07.2021	Ron Jost
Med.	BarracudaDrive v6.5 Insecure Folder Permissions	04.09.2020	Bobby Cooke
Low	Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Set_Task.cgi Permission Assignment	28.04.2019	Cisco Talos
High	aws-cfn-bootstrap Local Code Execution	04.12.2017	Harry Sintonen
Med.	SAP HANA SPS09 1.00.091.00.1418659308 EXPORT Information Disclosure	22.08.2016	Multiple
Low	Samsung SNS Provider Application For Android Access Theft	13.03.2015	Sadosky

---

CVEMAP Search Results

CVE

Details

Description

2023-10-25

CVE-2023-42489

Updating...

EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource

2023-10-10

	CVE-2022-30527	Updating...	A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing executable files and libraries. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
	CVE-2023-38640	Updating...	A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process.
	CVE-2023-45205	Updating...	A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to `NT AUTHORITY/SYSTEM`.

2023-10-05

CVE-2023-44387

Updating...

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

2023-09-14

CVE-2023-38557

Updating...

A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

2023-09-06

CVE-2023-32162

Updating...

Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the WacomInstallI.txt file by the PrefUtil.exe utility. The issue results from incorrect permissions on the WacomInstallI.txt file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16318.

2023-07-24

CVE-2023-3322

Updating...

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability�?? zenon: from 11 build through 11 build 106404.

2023-07-11

CVE-2023-33990

Updating...

SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.

2023-06-26

CVE-2023-35168

Updating...

DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.

 

---

Copyright 2023, cxsecurity.com