CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data...5.5 Medium
- google androidIn navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due...7.8 High
- mozilla thunderbirdWhen saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple...7.8 High
- brocade fabric os, broadcom fabric operating system +1 moreA privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9...7.8 High
- dell isilon onefs, emc isilon onefs +1 moreThe Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission...4.3 Medium
- red hat openshiftIn Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv...5.5 Medium
- asus asusliveupdate, asussoftwaremanger, system control interface +2 moreAsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running...6.0 Medium
- asus asusswitch, system control interface +1 moreAsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading...7.8 High
- avira security, nortonlifelock "avira security" – for windows +1 moreSoftware Updater of Avira Security for Windows vulnerable to Privilege Escalation7.3 High
- openharmonyKernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information inc…6.7 Medium
- atlassian jira alignThe MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An...8.8 High
- bushnellgolf launch pro firmware, foresightsports gc3 launch monitor firmware +1 moreForesight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service...8.0 High
- dell geodriveDell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions...7.0 High
- trend micro apex oneA registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP)...6.7 Medium
- liferay portalLiferay Portal Insecure Default Configuration in auth.login.prompt.enabled5.3 Medium
- beckmancoulter remisol advanceA vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message...7.8 High
- google androidThere is an unauthorized service in the system service. Since the component does not have...7.8 High
- google androidThere is a Unauthorized service in the system service, may cause the system reboot. Since the...7.8 High
- measuresoft scadapro serverMeasuresoft ScadaPro Server Improper Access Control7.8 High
- parse-community parse-serverParse Server subject to Incorrect Resource Transfer Between Spheres4.3 Medium
- huawei jad-al50 firmwareA permission bypass vulnerability in Huawei cross device task management could allow an attacker...5.5 Medium
- trendmicro housecall, trend micro housecall (consumer) +1 moreA vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local...7.8 High
- siemens coreshield one-way gateway (owg) software, coreshield one-way gateway +1 moreA vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions <...7.8 High
- octopus serverIn affected versions of Octopus Deploy it is possible to upload a package to built-in feed with...6.5 Medium
- opensuse factory, suse opensuse factory +1 moreslurm: %post for slurm-testsuite operates as root in user owned directory6.5 Medium
- totolink a3002r firmwareTOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions...9.8 Critical
- influxdata influxdbinfluxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing...9.8 Critical
- samba, fedoraproject fedora +1 moreSamba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which...7.5 High
- clusterlabs pcs, debian linux +1 moreA vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a...7.8 High
- vim gvimAn issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary...7.8 High
- redhat ansible runneransible-runner has default temporary files written to world R/W locations6.6 Medium
- planex mzk-dp150n firmwareInsecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows...7.2 High
- philips version, intel single event api +1 moreIncorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may...7.8 High
- intel open active management technology cloud toolkitAuthentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before...9.8 Critical
- intel supportIncorrect default permissions for the Intel(R) Support Android application before 21.07.40 may...5.5 Medium
- intel connect mIncorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4...5.5 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4,...4.3 Medium
- power-software-download viewpowerupsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure...7.8 High
- google androidIn ConnectivityService, there is a possible bypass of network permissions due to a missing...5.5 Medium
- google androidIn PackageManager, there is a possible way to determine whether an app is installed due to a...3.3 Low
- google androidIn Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a...2.8 Low
- google androidIn PackageManager, there is a possible installed package disclosure due to a missing permission...5.5 Medium
- google androidIn ActivityManager, there is a possible disclosure of installed packages due to a missing...3.3 Low
- google androidIn WifiP2pManager, there is a possible toobtain WiFi P2P MAC address without user consent due to...5.5 Medium
- google androidIn Telecomm, there is a possible disclosure of registered self managed phone accounts due to a...3.3 Low
- google androidIn Telecomm, there is a possible disclosure of registered self managed phone accounts due to a...3.3 Low
- google androidIn ContentService, there is a possible disclosure of available account types due to a missing...3.3 Low
- google androidIn ContentService, there is a possible way to determine if an account is on the device without...5.5 Medium
- google androidIn Content, there is a possible way to check if an account exists on the device due to a missing...5.5 Medium
- google androidIn Content, there is a possible way to check if the given account exists on the device due to a...5.5 Medium
- Show moreLoading…