CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This...7.8 High
- google androidIn checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to...5.5 Medium
- google androidIn updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass...5.5 Medium
- google androidIn onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify...7.8 High
- honor pcmanagerA denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042...5.5 Medium
- google android, samsung mobile devices +1 moreMissing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers...6.2 Medium
- advantech webaccess\/scadaAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- tasks"Tasks" application version before 9.7.3 is affected by insecure permissions. The...6.8 Medium
- facebook zstandardBeginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the...4.7 Medium
- sytech xlreporterAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- atlassian bitbucket, bitbucket server, bitbucket data center +2 moreThe Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6...7.8 High
- advantech webaccess\/scadaAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- advantech webaccess\/scadaAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- advantech webaccess\/scadaAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- advantech webaccess\/scadaAn exploitable local privilege elevation vulnerability exists in the file system permissions of...8.8 High
- intel ethernet controller i210 firmwareImproper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of...5.5 Medium
- intel realsense depth camera managerIncorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a...6.7 Medium
- intel solid-state drive toolboxIncorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021...6.7 Medium
- nec platforms, ltd. calsos csdj, nec csdj-a firmware, csdj-b firmware +2 more +4 moreCalsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and...5.3 Medium
- facebook zstandardIn the Zstandard command-line utility prior to v1.4.1, output files were created with default...5.5 Medium
- owncloud files antivirusWhen using an object storage like S3 as the file store, when a user creates a public link to a...5.7 Medium
- siemens simaris configurationA vulnerability has been identified in SIMARIS configuration (All versions). During installation...7.8 High
- siemens digsi 4A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders...7.8 High
- millewinMillennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1...8.8 High
- otrs ag otrscisincustomerfrontend, otrs cis in customer frontend +1 moreAgent is able to link customer's Config Items without permission3.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API...5.3 Medium
- jetbrains kotlin, oracle communications cloud native core network slice selection function, communications cloud native core policy +1 more +3 moreIncorrect Default Permissions in JetBrains Kotlin5.3 Medium
- tk-star q90 junior gps horloge firmwareAn issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices....9.8 Critical
- eset endpoint antivirus, endpoint security, file security +5 more +7 moreA local (authenticated) low-privileged user can exploit a behavior in an ESET installer to...5.5 Medium
- apache guacamoleUpdated guacd packages fix security vulnerabilities4.3 Medium
- canonical snapd, ubuntu linux +1 moresnapd created ~/snap with too-wide permissions3.8 Low
- apache dolphinschedulerApache DolphinScheduler (incubating) Permission vulnerability6.5 Medium
- thecodingmachine gotenbergIn Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg)...9.8 Critical
- debian linux, nvidia gpu display driver, gpu driver +2 moreNVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode...7.1 High
- dell unity, emc unity operating environment, emc unity vsa operating environment +1 more +3 moreDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text...6.4 Medium
- win911 mobile-911 server, win-911 +1 moreAn exploitable local privilege elevation vulnerability exists in the file system permissions of...9.3 Critical
- win-911An exploitable local privilege elevation vulnerability exists in the file system permissions of...9.3 Critical
- win-911An exploitable local privilege elevation vulnerability exists in the file system permissions of...9.3 Critical
- dell wyse thinos, wyse proprietary os (thinos) +1 moreDell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability....10.0 Critical
- dell wyse thinos, wyse proprietary os (thinos) +1 moreDell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability....10.0 Critical
- zammadAn issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base...4.3 Medium
- kepware linkmasterA privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default...9.3 Critical
- google androidIn getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission...3.3 Low
- google androidIn SELinux policies of mls, there is a missing permission check. This could lead to local...3.3 Low
- google androidIn broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission...4.4 Medium
- google androidIn postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe...5.5 Medium
- google androidIn openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to...7.8 High
- google androidIn areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest...7.8 High
- google androidIn createInputConsumer of WindowManagerService.java, there is a possible way to block and...7.8 High
- druva insyncinSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain...7.8 High
- Show moreLoading…