CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn ContentService, there is a possible way to check if the given account exists on the device due...5.5 Medium
- google androidIn ContentService, there is a possible way to check if an account exists on the device due to a...5.5 Medium
- google androidIn ContentService, there is a possible way to check if an account exists on the device due to a...5.5 Medium
- google androidIn ContentService, there is a possible way to check if an account exists on the device due to a...5.5 Medium
- google androidIn Content, there is a possible way to learn about an account present on the device due to a...5.5 Medium
- google androidIn Core, there is a possible way to start an activity from the background due to a missing...7.8 High
- google androidIn PermissionController, there is a possible misunderstanding about the default SMS application's...5.5 Medium
- google androidIn bluetooth, there is a possible way to enable or disable bluetooth connection without user...3.3 Low
- google androidIn ActivityManager, there is a way to read process state for other users due to a missing...5.5 Medium
- google androidIn LocationManager, there is a possible way to get location information due to a missing...2.3 Low
- google androidIn Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This...5.5 Medium
- google androidIn SettingsProvider, there is a possible way to read or change the default ringtone due to a...4.4 Medium
- google androidIn WindowManager, there is a possible bypass of the restrictions for starting activities from the...7.8 High
- google androidIn PackageManager, there is a possible way to get information about installed packages ignoring...5.5 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the network module. Successful exploitation of this...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThe AOD module has a vulnerability in permission assignment. Successful exploitation of this...9.8 Critical
- grommunio gromoxWeak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x...7.8 High
- google android, mediatek, inc. mt6580, mt6735, mt6739, mt6757, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8168, mt8173, mt8185, mt8321, mt8365, mt8385, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 +1 moreIn cta, there is a possible way to write permission usage records of an app due to a missing...7.8 High
- google androidIn setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This...7.8 High
- google androidIn startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected...3.3 Low
- google androidIn addProviderRequestListener of LocationManagerService.java, there is a possible way to learn...5.5 Medium
- google androidIn WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a...7.8 High
- google androidIn updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible...7.8 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from...5.1 Medium
- mattermost, mattermost server +1 moreIncorrect defaults can cause attackers to bypass rate limitations5.6 Medium
- huawei emui, harmonyos, magic ui +2 moreThe application security module has a vulnerability in permission assignment. Successful...9.1 Critical
- google android, samsung mobile devices +1 moreImplicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows...4.0 Medium
- google android, samsung mobile devices +1 moreImproper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1...3.3 Low
- devolutions serverIncorrect permission management in Devolutions Server before 2022.2 allows a new user with a...8.8 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5,...3.5 Low
- nomachineIncorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2...7.3 High
- openhwgroup cva6CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the...7.5 High
- haxx curl, apple macos, debian linux +15 more +17 moreWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation...9.8 Critical
- melag ftp serverWhen installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants...8.8 High
- melag ftp serverWeak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read...7.1 High
- redhat amq brokerA flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low...8.8 High
- checkmkA permission issue affects users that deployed the shipped version of the Checkmk Debian package....7.8 High
- octokit project octokit, octokit octokit.rb +1 moreOctokit gem published with world-writable files2.5 Low
- octopoller project octopoller, octokit octopoller.rb +1 moreOctopoller gem published with world-writable files2.5 Low
- couchbase serverAn issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection...8.8 High
- powertekpdus basic pdu firmware, piml pdu firmware, pm pdu firmware +4 more +6 morePower Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an...9.8 Critical
- huawei emui, harmonyos, magic ui +2 moreHwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this...5.3 Medium
- igel universal management suiteAn issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure...5.5 Medium
- samsung mobile smart things, samsung smartthings +1 morePendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers...5.5 Medium
- google androidIn onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner...7.3 High
- abb e-designe-Design - Multiple vulnerabilities7.8 High
- abb e-designe-Design - Multiple vulnerabilities6.1 Medium
- knime analytics platformIn KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.7.8 High
- apachefriends xamppXampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install...8.8 High
- bloodshed dev-c\+\+Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers...8.8 High
- Show moreLoading…