CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins cloudbees aws credentials, jenkins project cloudbees aws credentials plugin +1 moreMissing permission checks in AWS Credentials Plugin4.3 Medium
- kingsoft wps office, wps office software office for windows +1 moreThe installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure...7.8 High
- gnu grub2, fedoraproject fedora +1 moreA flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with...3.3 Low
- google android, samsung mobile devices +1 morePendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1...5.5 Medium
- google android, samsung mobile devices +1 morePendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release...5.5 Medium
- secomea gatemanagerGateManager information leak for LinkManager Users5.0 Medium
- northern.tech cfengineNorthern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow...5.5 Medium
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions...5.5 Medium
- huawei emui, harmonyos, magic ui +2 moreThere is a permission control vulnerability in the PMS module. Successful exploitation of this...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThere is a permission control vulnerability in the Nearby module. Successful exploitation of this...9.1 Critical
- huawei emui, magic ui +1 moreThere is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this...6.5 Medium
- jfrog artifactoryJFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin...2.7 Low
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP has incorrect default permissions for site members6.5 Medium
- batflatInsecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the...7.5 High
- google androidIn sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message...7.8 High
- google androidIn onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials...7.8 High
- google androidIn parse of RoleParser.java, there is a possible way for default apps to get permissions...7.8 High
- huawei emui, magic ui +1 moreThere is an improper permission management vulnerability in the Wallet apps. Successful...5.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked...6.5 Medium
- google fscryptLocal Denial of Service in fscrypt PAM module5.5 Medium
- win-911, win-911 2021 r1, 2021 r2 +2 moreWIN-911 2021 Incorrect Default Permissions5.6 Medium
- win-911, win-911 2021 r1, 2021 r2 +2 moreWIN-911 2021 Incorrect Default Permissions5.6 Medium
- cobbler project cobbler, fedoraproject fedora +1 moreIncorrect Default Permissions in Cobbler7.1 High
- konveyor mig-controller, redhat migration toolkit +1 moreAn incorrect default permissions vulnerability was found in the mig-controller. Due to an...6.3 Medium
- google androidIn checkUriPermission of MediaProvider.java , there is a possible way to gain access to the...7.8 High
- mitsubishi electric c controller interface module utility, cc-link ie control network data collector, cc-link ie field network data collector +52 more +54 moreMitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element8.3 High
- samsung wear os, samsung mobile wearable devices +1 moreUnprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware...4.0 Medium
- samsung wear os, samsung mobile wearable devices +1 moreUnprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to...4.0 Medium
- debian debian-edu-config, linux +1 moreIt was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu...9.8 Critical
- schneider-electric vijeo designer, hmibmiea5dd1001 firmware, hmibmiea5dd100a firmware +34 more +36 moreA CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized...7.8 High
- intel quartus primeImproper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an...7.8 High
- philips version, intel retail experience tool +1 moreIncorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may...5.5 Medium
- intel advisorIncorrect default permissions in the software installer for the Intel(R) Advisor before version...7.8 High
- intel atom c3308, atom c3336, atom c3338 +678 more +680 moreIncorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged...4.4 Medium
- acronis agent, cyber protect 15, cyber protect home office +3 more +5 moreLocal privilege escalation due to excessive permissions assigned to child processes7.8 High
- minetest, debian linux +1 moreIn Minetest before 5.4.0, players can add or subtract items from a different player's inventory.6.5 Medium
- elitecms elite cmseliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.9.8 Critical
- google androidismsEx service is a vendor service in unisoc equipment?ismsEx service is an extension of sms...9.8 Critical
- google androidims_ex is a vendor system service used to manage VoLTE in unisoc devices?But it does not verify...9.1 Critical
- samba, fedoraproject fedora +1 moreThe Samba AD DC includes checks when adding service principals names (SPNs) to an account to...8.8 High
- reolink rlc-410w firmwareAn incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability...7.1 High
- reolink rlc-410w firmwareAn incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability...7.1 High
- reolink rlc-410w firmwareAn incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability...7.1 High
- reolink rlc-410w firmwareAn incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability...7.1 High
- advantech wise-paas\/otaA privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server...8.8 High
- advantech deviceon\/iserviceA privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1...8.8 High
- advantech deviceon\/iedgeA privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge...8.8 High
- advantech sq managerA privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially...8.8 High
- nextcloud, kiteworks security-advisories +1 morePermission bypass in Nextcloud Android App4.3 Medium
- Show moreLoading…