CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed...9.6 Critical
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed...9.6 Critical
- dolibarr erp\/crmDolibarr Stored Cross-site Scripting5.4 Medium
- panasonic eluga ray 530 firmware, eluga ray 600 firmware, eluga x1 firmware +3 more +5 morePanasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure...9.8 Critical
- tibco jasperreports server, tibco software inc. jasperreports server for activematrix bpm, jasperreports server for aws marketplace +1 more +3 moreTIBCO JasperReports Server Fails To Enforce Access Restrictions9.8 Critical
- msi dragon centerWeak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center 2.6.2003.2401,...7.8 High
- eq-3 ccu3 firmware, homematic ccu2 firmware +1 moreeQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote...9.8 Critical
- google androidIn onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification...7.8 High
- ibm sterling file gatewayIBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could...6.5 Medium
- dahuasecurity ipc-hdbw1320e-w firmware, ipc-hx2xxx firmware, ipc-hx5842h firmware +17 more +19 moreDahua devices with Build time before December 2019 use strong security login mode by default, but...8.1 High
- f5 big-ip access policy manager, big-ip access policy manager client +1 moreOn versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder...7.8 High
- solarwinds managed service provider patch management engineAn issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1...7.8 High
- jenkins copy artifact, jenkins project copy artifact plugin +1 moreImproper permission checks in Jenkins Copy Artifact Plugin6.5 Medium
- suse linux enterprise server 15 sp1, linux enterprise desktop +1 moreUser owned /etc in SLES15-SP1-CHOST-BYOS8.4 High
- xt-commerceThe address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to...4.3 Medium
- gitlabGitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if...5.3 Medium
- abb advabuild, central licensing system, compact hmi +15 more +17 moreABB Central Licensing System - Weak File Permissions7.8 High
- binance tss-libIncorrect Default Permissions in Binance tss-lib8.2 High
- juplink rx4-1500 firmwarehttpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router...5.5 Medium
- supsystic data tables generatorThe data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks...6.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.2.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import...6.5 Medium
- intel data migration, intel corporation intel(r) data migration software +1 moreIncorrect default permissions in the installer for Intel(R) Data Migration Software versions 3.3...7.8 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to access data and perform...5.4 Medium
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a local user to gain escalated privileges due to...8.4 High
- andyroid andy osAn issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and...7.8 High
- s3india husky rtu 6049-e70 firmwareThe Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior,...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a...4.3 Medium
- paloaltonetworks secdoSecdo: Incorrect Default Permissions7.8 High
- google androidAn issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger...6.8 Medium
- google androidAn issue was discovered on Samsung mobile devices with M(6.0) software. Attackers can prevent...7.5 High
- google androidAn issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an...7.5 High
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure...8.8 High
- sonatype nexusSonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.8.8 High
- parrot anafi firmwareParrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated...7.5 High
- toyota display control unit, toyota motor corporation dcu (display control unit) +1 moreToyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within...8.8 High
- phoenixcontact pc worx srtInsecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local...7.8 High
- adobe genuine integrity serviceAdobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file...7.8 High
- druva insyncImproper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to...7.8 High
- google androidAn issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) (released in...9.8 Critical
- supsystic pricing table by supsysticAn issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress....7.3 High
- hashicorp vaultHashiCorp Vault Improper Privilege Management5.3 Medium
- it-novum openitcockpitopenITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self:...7.5 High
- netsas enigma network management solutionA number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world...8.8 High
- fortinet fortibalancer 1000 firmware, fortibalancer 2000 firmware, fortibalancer 3000 firmware +1 more +3 moreIn FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has...8.8 High
- Show moreLoading…