CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to...7.8 High
- google androidIn the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in...6.7 Medium
- google androidIn getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to...5.5 Medium
- opensuse factory, leap 15.1, leap 15.2 +2 more +4 moreProblematic permissions in hylafax+ packaging allow escalation from uucp to other users5.3 Medium
- idriveIDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with...7.8 High
- apache tomcat, suse enterprise storage 5, linux enterprise server 12-sp2-bcl +13 more +15 moreUser-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges7.7 High
- aliasrobotics mir1000 firmware, mir100 firmware, mir200 firmware +8 more +10 moreRVD#2569: Insecure operating system defaults in MiR robots10.0 Critical
- google guest-oslogin, opensuse leap +1 morePriviged Escalation in Google Cloud Platform's Guest-OSLogin9.3 Critical
- google guest-oslogin, opensuse leap +1 morePriviged Escalation in Google Cloud Platform's Guest-OSLogin9.3 Critical
- google guest-oslogin, opensuse leap +1 morePriviged Escalation in Google Cloud Platform's Guest-OSLogin7.3 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8053 firmware, apq8096au firmware +34 more +36 moreAny application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice...7.8 High
- mattermost serverMattermost Server server restarts may provide attackers with API access9.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles...5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain...5.3 Medium
- rtslib-fb project rtslib-fbrtslib-fb weak permissions for /etc/target/saveconfig.json file7.8 High
- red hat ansible towerAn exposure of sensitive information flaw was found in Ansible Tower before version 3.7.1....6.5 Medium
- openmicroscopy omero.serverIn ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO...7.5 High
- geti2p i2pI2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file...7.8 High
- openbmc-project openbmcuser_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that...8.8 High
- google androidIn onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due...7.8 High
- google androidIn onStart of MainActivity.java, there is a possible bypass of developer settings requirements...7.8 High
- google androidIn setIPv6AddrGenMode of NetworkManagementService.java, there is a possible bypass of networking...7.8 High
- google androidIn MockLocationAppPreferenceController.java, it is possible to mock the GPS location of the...7.3 High
- google androidIn multiple functions of AccountManager.java, there is a possible permissions bypass. This could...7.8 High
- google androidIn dump of RollbackManagerServiceImpl.java, there is a possible backup metadata exposure due to a...4.4 Medium
- google androidIn multiple functions of AccountManager.java, there is a possible permissions bypass. This could...7.8 High
- google androidIn checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user...5.5 Medium
- google androidIn updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic...5.5 Medium
- gitlabMissing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1...7.5 High
- apple macos, mac os x +1 moreA permissions issue existed. This issue was addressed with improved permission validation. This...7.8 High
- citrix workspace appCitrix Workspace App before 2006.1 on Windows has Insecure Permissions for %PROGRAMDATA%\Citrix ...7.8 High
- citrix workspace appCitrix Workspace App before 2006.1 on Windows has Insecure Permissions for "%PROGRAMDATA%\Citrix...7.8 High
- asus rt-n11, broadcom adsl, canon selphy cp1200 +214 more +216 moreThe Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the...7.5 High
- openbrowser project openbrowserOpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in...5.4 Medium
- qbik wingateWinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local...7.8 High
- dext5handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download...7.5 High
- targetcli-fb project targetcli-fb, fedoraproject fedora +1 moreOpen-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup...5.5 Medium
- google chrome, debian linux +1 moreIncorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed...6.5 Medium
- google chrome, debian linux +1 moreInsufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed...6.5 Medium
- google chrome, debian linux, opensuse backports +1 more +3 moreInsufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed...6.5 Medium
- jenkins project inheritance, jenkins project inheritance plugin +1 moreMissing permission check in Jenkins Project Inheritance Plugin4.3 Medium
- jenkins project self-organizing swarm plug-in modules plugin, jenkins self-organizing swarm modules +1 moreImproper permission checks in Jenkins Swarm Plugin4.3 Medium
- digi xbee 2 firmwareDigi XBee 2 devices do not have an effective protection mechanism against remote AT commands,...7.7 High
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an...6.5 Medium
- Show moreLoading…