CWE-732

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS

In the Activity Manager service, there is a possible permission bypass due to incorrect permission check. This could lea

Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attach

An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locall

Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authe

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files

drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-37

ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel c

A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel

Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege es

Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was p

Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual ma

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escala

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly

Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replac

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco

Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allo

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26

The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durati

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service v

Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attac

An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_w

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.wri

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie

An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable.

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can i

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to

OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. Dur

Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may

The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)

WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, l

Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an aut

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.17

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated

Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated

NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Priv

Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Troj

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AU

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical at

iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers

Insufficient access control in Intel(R) Capability Licensing Service before version 1.50.638.1 may allow an unprivileged