CVE-2018-12615: Incorrect Permission Assignment for Critical Resource

An issue was discovered in switchGroup in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups gidset is not set correctly, leaving it up to randomness i.e., uninitialized memory which supplementary groups are actually being set while lowering privileges...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2017-1624)

Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVEID: CVE-2017-1624 DESCRIPTION: IBM QRadar specifies permissions for a security-critical resource in a way that allow...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-9722)

Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-9722 Description: IBM QRadar specifies permissions for a security-critical resource in a way that allo...

Security Bulletin: Incorrect Permission Assignment for Critical Resource vulnerability affects IBM Security Guardium (CVE-2017-1266 )

Summary IBM Security Guardium specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM Security Guardium has provided a fix for this vulnerability. Vulnerability Details CVEID: CVE-2017-1266 DESCRIPTION: IBM Securit...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-2877)

Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-2877 Description: IBM QRadar could allow a local user to write files to certain web accessible...

CVE-2017-7821: Incorrect Permission Assignment for Critical Resource

A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those...

CVE-2012-0433: Incorrect Permission Assignment for Critical Resource

The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...

CVE-2018-4251: Incorrect Permission Assignment for Critical Resource

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Firmware" component. It allows attackers to modify the EFI flash-memory region that a crafted app that has root access...

CVE-2018-4220: Incorrect Permission Assignment for Critical Resource

An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is affected. The issue involves the "Swift for Ubuntu" component. It allows attackers to execute arbitrary code in a privileged context because write and execute permissions are enabled during library...

CVE-2017-18285: Incorrect Permission Assignment for Critical Resource

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18284: Incorrect Permission Assignment for Critical Resource

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2018-11193: Incorrect Permission Assignment for Critical Resource

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 5 of 6...

CVE-2018-11192: Incorrect Permission Assignment for Critical Resource

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 4 of 6...

CVE-2018-11194: Incorrect Permission Assignment for Critical Resource

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 6 of 6...

CVE-2018-1370: Incorrect Permission Assignment for Critical Resource

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

CVE-2018-1115: Incorrect Permission Assignment for Critical Resource

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pgcatalog.pglogfilerotate function doesn't follow the same ACLs than pgroratelogfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation...

CVE-2018-5342: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

CVE-2017-1624: Incorrect Permission Assignment for Critical Resource

IBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 133122...

CVE-2018-1141: Incorrect Permission Assignment for Critical Resource

When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location...

CVE-2017-1459: Incorrect Permission Assignment for Critical Resource

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 128378...