Incorrect Permission Assignment (CWE-732)
4 CVEs of this weakness class.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2019 | 2 | 2 |
| 2020 | 0 | 0 |
| 2021 | 1 | 0 |
| 2022 | 1 | 1 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2019-15752HIGH 7.8KEVEPSS 49%
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
- CVE-2022-22960HIGH 7.8KEVEPSS 36%
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
- CVE-2018-13374MED 4.3KEVEPSS 38%
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
- CVE-2021-34110HIGH 7.8Real · low riskEPSS 1%
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.