CWE-275: Permission Issues
Weaknesses in this category are related to improper assignment or handling of permissions.
From the CWE List. © The MITRE Corporation.
Newest
- intel driver \& support assistantImproper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an...7.8 High
- intel driver \& support assistantImproper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an...7.8 High
- cpanelcPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).3.3 Low
- cpanelIn cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).3.3 Low
- cpanelIn cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).2.5 Low
- cpanelIn cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC...3.3 Low
- cpanelcPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).3.3 Low
- cpanelcPanel before 68.0.15 allows code execution in the context of the root account because of weak...7.8 High
- cpanelcPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd...6.5 Medium
- cpanelcPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube...8.1 High
- cloudera managerSecret data of processes managed by CM is not secured by file permissions.6.5 Medium
- open-xchange appsuiteOX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.9.8 Critical
- cisco nexus 9000 series switches in standalone nx-os mode, nx-os +1 moreCisco Nexus 9000 Series Switches Standalone NX-OS Mode Tetration Analytics Agent Arbitrary Code Execution Vulnerability7.8 High
- cisco jabber for mac, jabber +1 moreCisco Jabber Client Framework Insecure Directory Permissions Vulnerability5.1 Medium
- ibm integration bus, websphere message broker +1 moreIBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message...4.0 Medium
- cisco prime infrastructureCisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability9.8 Critical
- red hat jboss enterprise application platformIt was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise...7.8 High
- phpmyfaqphpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read...5.3 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for...4.2 Medium
- red hat ipa, freeipa, redhat enterprise linux +5 more +7 moreA vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did...8.1 High
- cisco mobility services engine 3310 firmware, mobility services engine 3355 firmware, mobility services engine 3365 firmware +2 moreA vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to...5.5 Medium
- mozilla firefoxA previously installed malicious Android application which defines a specific signature-level...7.5 High
- mozilla firefoxA previously installed malicious Android application with same signature-level permissions as...7.5 High
- opensuse open build serviceNo write permission check in change_role command8.8 High
- gofer project gofergofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which...4.4 Medium
- katelloKatello allows remote authenticated users to call the "system remove_deletion" CLI command via...4.3 Medium
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x...5.5 Medium
- invincea dell protected workspace, sophos invincea dell protected workspace +1 moreMultiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected...7.8 High
- hewlett packard enterprise data protectorA Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9...5.5 Medium
- eucalyptus, hewlett packard enterprise helion eucalyptus +1 moreHPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for...8.8 High
- eventum project eventumhtdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute...8.1 High
- eventum project eventumEventum before 2.3.5 allows remote attackers to reinstall the application via direct request to ...7.5 High
- fiberhome lm53q1 firmwareThe portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web...9.8 Critical
- google androidThe SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR...5.5 Medium
- iwcnetwork shiftBiometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file...7.5 High
- ivanti endpoint managerIn Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an...8.8 High
- huawei vmall, huawei technologies co., ltd. vmall (for android) +1 moreHuawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation...7.1 High
- huawei vmall, huawei technologies co., ltd. hwvmall +1 moreThe AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control...3.3 Low
- apple iphone osAn issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves...5.3 Medium
- apple safari, iphone os +1 moreAn issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is...4.3 Medium
- apple iphone osAn issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves...5.9 Medium
- juniper junos, juniper networks junos os +1 morevMX: Information leak vulnerability8.4 High
- huawei ch121 v3 firmware, ch220 v3 firmware, ch222 v3 firmware +7 more +9 moreHuawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3...7.1 High
- polycom btoe connectorPolycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program...7.8 High
- pulp project pulpPulp does not remove permissions for named objects upon deletion, which allows authenticated...8.8 High
- zohocorp manageengine firewall analyzerManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.7.5 High
- cybozu officeCybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended...4.3 Medium
- huawei p7 firmware, p8 ale-ul00 firmware +1 moreHuawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE...5.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders...4.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via...6.4 Medium
- Show moreLoading…