CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- fortinet fortibalancer 1000 firmware, fortibalancer 2000 firmware, fortibalancer 3000 firmware +1 more +3 moreIn FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has...8.8 High
- fortinet fortibalancer 1000 firmware, fortibalancer 2000 firmware, fortibalancer 3000 firmware +1 more +3 moreIn FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has...8.8 High
- intel graphics driver, intel(r) graphics drivers +1 moreImproper default permissions in the installer for Intel(R) Graphics Drivers before versions 26.20...7.8 High
- intel graphics driver, intel(r) graphics drivers +1 moreIncorrect default permissions in the installer for Intel(R) Graphics Drivers before versions 15...7.8 High
- perforce puppet enterprise, puppet server, enterprise +1 more +3 morePuppet Server and PuppetDB provide useful performance and debugging information via their metrics...7.5 High
- tibco spotfire analytics platform for aws, spotfire server, tibco software inc. spotfire analytics platform for aws marketplace +2 moreTIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability9.9 Critical
- openstack manilaOpenStack Manila Unprivileged users can retrieve, use and manipulate share networks8.3 High
- google chromeIncorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote...6.5 Medium
- dell digital delivery, digital delivery (cirrus) +1 moreDell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions...7.8 High
- eset cyber securityA permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to...5.2 Medium
- apple ios, ipados, macos +4 more +6 moreThe issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and...7.8 High
- couchbase serverCouchbase Server 4.x and 5.x before 6.0.0 has Insecure Permissions for the projector and indexer...9.8 Critical
- intel raid web console 2Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated...7.8 High
- intel raid web console 3Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000...7.8 High
- intel renesas electronics usb 3.0 driverImproper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all...7.8 High
- google androidIn setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user...5.5 Medium
- google androidIn updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to...7.3 High
- jenkins pipeline github notify step, jenkins project pipeline github notify step plugin +1 moreUsers with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin4.3 Medium
- jenkins pipeline github notify step, jenkins project pipeline github notify step plugin +1 moreMissing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials4.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8053 firmware, apq8096au firmware +27 more +29 moreAPKs without proper permission may bind to CallEnhancementService and can lead to unauthorized...7.8 High
- atlassian jira, jira server and data center, jira server +2 more +4 moreComment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0...4.3 Medium
- gitlabGitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).4.3 Medium
- gitlabGitLab EE 12.2 has Insecure Permissions (issue 2 of 2).7.5 High
- gitlabGitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.5.3 Medium
- gitlabGitLab EE 8.9 and later through 12.7.2 has Insecure Permission5.3 Medium
- gitlabGitLab EE 8.9 and later through 12.7.2 has Insecure Permission9.8 Critical
- apereo opencastOpencast users with ROLE_COURSE_ADMIN can create new users4.8 Medium
- wowza streaming engineA privilege escalation vulnerability in Wowza Streaming Engine 4.7.7 and 4.7.8 allows any...7.8 High
- hp sgi tempoSGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows...7.8 High
- hp sgi tempoSGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows...7.8 High
- hp sgi tempoSGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows...6.6 Medium
- bitdefender av for mac, antivirus +1 moreGet-task-allow entitlement via BDLDaemon on macOS4.9 Medium
- suse linux enterprise server"easy" permission profile allows everyone execute dumpcap and read all network traffic4.0 Medium
- ixpdata easyinstallIn IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine...9.9 Critical
- fortinet fortiosImproper permission or value checking in the CLI console may allow a non-privileged user to...5.5 Medium
- fordnn usersexportimportThe forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an...9.8 Critical
- intel intel(r) rwc 3 for windows, raid web console 3 +1 moreImproper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000...7.8 High
- cerberusftp ftp serverCerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an...8.1 High
- opensuse libzypp, suse caas platform 3.0, linux enterprise server 12 +1 more +3 morelibzypp stores cookies world readable4.0 Medium
- zohocorp manageengine applications managerAn issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated...8.8 High
- cipherdyne fwknopfwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash)...8.8 High
- webfactoryltd minimal coming soon \& maintenance modeA flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows...5.4 Medium
- google android, debian linux +1 moreIn calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a...5.5 Medium
- open-xchange appsuiteOX App Suite through 7.10.2 has Incorrect Access Control.6.6 Medium
- insteon hub firmwareINSTEON Hub 2242-222 lacks Web and API authentication8.1 High
- samsung galaxy s3 firmware, galaxy s4 firmware +1 moreSamsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send...4.3 Medium
- samsung galaxy s3 firmware, galaxy s4 firmware +1 moreSamsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages...4.6 Medium
- adobe coldfusionColdFusion versions Update 6 and earlier have an insecure inherited permissions of default...9.8 Critical
- intel trusted execution engine firmwareImproper directory permissions in the installer for Intel(R) Management Engine Consumer Driver...7.8 High
- Show moreLoading…