CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- intel distribution for python, intel corporation intel(r) distribution for python 2018 +1 moreDefault install directory permissions in Intel Distribution for Python (IDP) version 2018 may...7.8 High
- intel data migration software, intel corporation intel(r) data migration software +1 moreDLL injection vulnerability in software installer for Intel Data Center Migration Center Software...5.3 Medium
- siemens simatic step 7 \(tia portal\), simatic wincc \(tia portal\), siemens ag simatic step 7 (tia portal) and wincc (tia portal) v10, v11, v12, simatic step 7 (tia portal) and wincc (tia portal) v13, simatic step 7 (tia portal) and wincc (tia portal) v14, simatic step 7 (tia portal) and wincc (tia portal) v15 +2 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10,...8.6 High
- siemens simatic step 7 \(tia portal\), simatic wincc \(tia portal\), siemens ag simatic step 7 (tia portal) and wincc (tia portal) v10, v11, v12, simatic step 7 (tia portal) and wincc (tia portal) v13, simatic step 7 (tia portal) and wincc (tia portal) v14, simatic step 7 (tia portal) and wincc (tia portal) v15 +2 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10,...7.8 High
- fujitsu displayview click, displayview click suite, hp display assistant +4 more +6 moreApplications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution7.8 High
- dbpower u818a wifi quadcopter drone, u818a firmware +1 moreThe DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user8.1 High
- h2database h2An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function...6.5 Medium
- hcl software compass, selinc sel compass +1 moreSEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory,...8.8 High
- mcafee data loss prevention (dlp) for windows, data loss prevention endpoint +1 more- Data Loss Prevention (DLP) for Windows - Exploiting Incorrectly Configured Access Control Security Levels vulnerability7.2 High
- totalavAn issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of...7.8 High
- npm-script-demo project npm-script-demo, hackerone npm-script-demo node module +1 morenpm-script-demo is malware9.8 Critical
- pandora-doomsday project pandora-doomsday, hackerone pandora-doomsday node module +1 morepandora-doomsday is malware9.8 Critical
- juniper jsnapy, juniper networks junos snapshot administrator (jsnapy) +1 moreJunos Snapshot Administrator (JSNAPy) world writeable default configuration file permission5.5 Medium
- osisoft pi data archiveAn Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017...7.8 High
- freedesktop xdg-user-dirs, redhat enterprise linux, red hat, inc. rhel shipped xdg-user-dirs and gnome-session +2 moreIt was found that system umask policy is not being honored when creating XDG user directories,...7.8 High
- ui unifi videoUbiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation...7.8 High
- google androidAn elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product:...9.8 Critical
- mitrastar dsl-100hn-t1 firmware, gpt-2541gnac firmware +1 moreMitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote...8.8 High
- jenkins pipeline\Jenkins Build Step Plugin fails to check Item/Build permission5.3 Medium
- jenkins parameterized triggerParameterized Trigger Plugin fails to check Item/Build permission6.5 Medium
- cisco ios xeA vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an...8.8 High
- dlink dir-850l firmwareD-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware...7.8 High
- dlink dir-850l firmwareD-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware...7.8 High
- dlink dir-850l firmwareD-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware...7.8 High
- azeotech daqfactoryAn Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17...7.1 High
- nomachineAn unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows...8.8 High
- synology download stationSynology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions ...7.8 High
- mozilla firefoxOn Linux systems, if the content process is compromised, the sandbox broker will allow files to...7.8 High
- microsoft internet explorerInternet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an...8.8 High
- hashicorp vagrant vmware fusionHashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak...8.8 High
- supervisord supervisor, debian linux, fedoraproject fedora +1 more +3 moreIncorrect Default Permissions in Supervisor8.8 High
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default...7.1 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable...5.5 Medium
- atlassian confluence, confluence server +1 moreAtlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to...4.3 Medium
- pivotal pcf tile generatorAn issue was discovered in Pivotal PCF Tile Generator versions prior to 6.0.0. Tiles created by...7.5 High
- schneider-electric wonderware indusoft web studioAn Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft...7.8 High
- mediawiki, debian linux +1 moreSysops can undelete pages, although the page is protected against it6.5 Medium
- intel nuc nuc6i5sysh/k, intel nuc6i3sysh/k, nuc6i3syh bios, nuc6i3syk bios +2 moreThe BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may...3.9 Low
- intel nuc nuc6i7kyk, nuc6i7kyk bios +1 moreThe BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may...3.9 Low
- intel compute stick stk2mv64cc, stk2mv64cc bios +1 moreThe BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version...3.9 Low
- apache ambariDuring installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with...9.8 Critical
- oneplus oxygenosWith OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device,...5.9 Medium
- veritas netbackup, netbackup appliance +1 moreAn issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There...5.5 Medium
- apache tomcatThe Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and...7.8 High
- debian pdns, linux +1 morepdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user...9.8 Critical
- watchguard panda endpoint administration agentPanda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business...7.8 High
- watchguard panda url filteringPanda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering...7.8 High
- valvesoftware steam clientValve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder,...7.2 High
- fal sftp project sftpfal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders4.0 Medium
- redhat jboss enterprise application platform, red hat jboss enterprise application platform 5 for rhel 6, jboss enterprise application platform 7 +2 more +4 moreJboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions5.5 Medium
- Show moreLoading…