CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- dlink dsl-g2452dg firmwareD-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.9.8 Critical
- ciliumIncorrect Default Permissions in Cilium8.8 High
- fidelis cybersecurity deception, network +1 morePrivileged Command Injection Vulnerability in Fidelis Network and Deception4.4 Medium
- fidelis cybersecurity deception, network +1 moreLocal Privilege Escalation Vulnerability in Fidelis Network and Deception3.9 Low
- nextcloud talk, kiteworks security-advisories +1 moreExposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk2.4 Low
- linuxfoundation runc, fedoraproject fedora +1 moreIncorrect Default Permissions in runc5.9 Medium
- simple social networking site project social networking siteSourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes...6.5 Medium
- air cargo management system project cargo management systemAir Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f...6.5 Medium
- debian linux, linux kernel, netapp 8300 firmware +10 more +12 moreThe Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows...7.8 High
- ijoomla guruExtension - Insecure Permissions within Joomla Guru extensions7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...8.8 High
- google androidIn checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due...7.8 High
- maharaIn Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is...7.5 High
- ciphermail webmail messengerAn issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker...5.5 Medium
- honor pcmanagerA denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175...5.0 Medium
- cisco virtualized infrastructure managerCisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability7.8 High
- mi content centerA improper permission configuration vulnerability in Xiaomi Content Center APP. This...5.3 Medium
- mediawiki createredirectThe CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the...7.5 High
- fanuc roboguideICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform6.0 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to check permissions to view sites/groups4.3 Medium
- wordpressA flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking...6.5 Medium
- kubernetes cri-o, mobyproject moby, fedoraproject fedora +1 more +3 moreIncorrect Default Permissions in CRI-O5.3 Medium
- samsung recoveryImproper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local...4.4 Medium
- discoursePrivate group name exposure in discourse5.3 Medium
- ofcms project ofcmsInsecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1...5.4 Medium
- febs-security project febs-securityInsecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security...5.4 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions...5.5 Medium
- codesys control for beaglebone sl, control for beckhoff cx9020 sl, control for empc-a/imx6 sl +9 more +11 moreA bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.6.5 Medium
- containers crun, fedoraproject fedora, redhat enterprise linux +1 more +3 moreImportant: container-tools:rhel8 security, bug fix, and enhancement update7.5 High
- containers podman, fedoraproject fedora, redhat developer tools +11 more +13 morePodman's default inheritable capabilities for linux container not empty7.5 High
- buildah project buildah, fedoraproject fedora, redhat enterprise linux +2 moreNon-empty default inheritable capabilities for linux container in Buildah6.8 Medium
- google androidIn broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the...7.8 High
- google androidIn Traceur, there is a possible bypass of developer settings requirements for capturing system...7.8 High
- google androidIn getCallStateUsingPackage of Telecom Service, there is a missing permission check. This could...5.5 Medium
- google androidIn Framework, there is a possible disclosure of the device owner package due to a missing...5.5 Medium
- google androidIn Device Policy, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn InputMethodEditor, there is a possible way to access some files accessible to Settings due to...5.5 Medium
- google androidIn Settings Provider, there is a possible way to list values of non-readable global settings due...5.5 Medium
- google androidIn createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission...7.8 High
- google androidIn createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible...7.8 High
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains an information disclosure vulnerability due to improper permission of...6.5 Medium
- delta electronics diaenergieDelta Electronics DIAEnergie Incorrect Default Permissions7.8 High
- checkmkThe web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a...8.8 High
- cef fortessa ftbtld firmwareIncorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13...8.2 High
- gradle enterpriseGradle Enterprise before 2022.1 allows remote code execution if the installation process did not...9.8 Critical
- f-secure safe, safe browser for android version 18.5 & below +1 moreF-Secure SAFE Browser vulnerable to USSD attacks4.3 Medium
- clickstudios passwordstateIn Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain...6.5 Medium
- google sa360 webquery to bigquery exporter, google llc google/sa360-webquery-bigquery +1 moreInformation Leak in SA360-webquery-bigquery through read on /tmp5.5 Medium
- gradle enterpriseIn Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed...8.1 High
- jenkins extended choice parameter, jenkins project extended choice parameter plugin +1 moreCSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF4.3 Medium
- Show moreLoading…