Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU Incorrect Default Permissions (CVE-2019-14925)

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world- readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and oth...

Rockwell Automation MicroLogix Incorrect Permission Assignment for Critical Resource (CVE-2016-9338)

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD,...

Code injection

Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server...

CVE-2021-22284

Summary of CVE-2021-22284 (ABB OPC Server for AC 800M) Affected product: ABB OPC Server for AC 800M (versions in 5.x/6.x range affected; see advisories). Vulnerability: Incorrect Permission Assignment for Critical Resource, enabling an authenticated remote user with low privileges to insert and e...

CVE-2021-22284 SECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability

Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server...

Microweber Incorrect Permission Assignment for Critical Resource vulnerability

In Microweber prior to 1.2.11, a non-admin user is able to access other users' sensitive information...

GHSA-VCGF-VMPC-PH79 Microweber Incorrect Permission Assignment for Critical Resource vulnerability

In Microweber prior to 1.2.11, a non-admin user is able to access other users' sensitive information...

CVE-2022-0277

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0277

CVE-2022-0277 affects microweber/microweber prior to version 1.2.11, due to an incorrect permission assignment for a critical resource . This allows a non-admin user to access other users’ sensitive information (improper access control). The issue is documented across multiple sources, which cons...

CVE-2022-0277 Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0277 Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...

GHSA-558X-H7RG-997V Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...

Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin

Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file. Credentials...

GHSA-GQM2-2GCX-P88W Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin

Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file. Credentials...

Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used...

GHSA-W2MH-6XJ5-F77F Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used...

CVE-2021-20874

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

CVE-2021-20874

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

CVE-2021-20874

CVE-2021-20874 involves incorrect permission assignment in GroupSession components (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier). The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource), enabling a remote unauthenticated attacker ...