CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- marvalglobal msmMarval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote...9.8 Critical
- samsung exynos 5123 firmware, exynos 5300 firmware +1 moreAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An...9.8 Critical
- perforce puppet enterprise, puppet enterprise +1 moreA privilege escalation allowing remote code execution was discovered in the orchestration service.9.8 Critical
- lenovo thinkpad hybrid usb-c with usb-a dock firmware update tool, thinkpad hybrid usb-c with usb-a dock firmware +1 moreA local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware...7.8 High
- google androidIn onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard...7.8 High
- google androidIn onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or...7.8 High
- google androidIn bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI...7.8 High
- google androidIn onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due...7.8 High
- google androidIn getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a...7.8 High
- google androidIn various functions of AppStandbyController.java, there is a possible way to break manageability...7.8 High
- google androidIn bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch...7.8 High
- google androidIn onResume of AppManagementFragment.java, there is a possible way to prevent users from...7.8 High
- deno, deno runtime +1 moreDeno missing "--allow-net" permission check for built-in Node modules8.6 High
- asustor download centerA Gain Information vulnerability was found on Download Center.8.6 High
- dell powerpath, powerpath windows +1 morePowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions...7.0 High
- zyxel gs1900-8 firmware, gs1900-8hp firmware, gs1900-10hp firmware +7 more +9 moreThe privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administ…6.7 Medium
- dualspace lock masterThe Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its...7.8 High
- loka soliveSoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method...9.8 Critical
- loka soliveSoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify...7.5 High
- ebankitIn ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate...7.4 High
- goreleaser nfpmnfpm vulnerable to Incorrect Default Permissions7.1 High
- contec solarview compact firmwareSolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be...9.1 Critical
- allwaysyncInsecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a...7.8 High
- huawei emui, harmonyos +1 moreThe Settings module has the file privilege escalation vulnerability.Successful exploitation of...7.5 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous...7.8 High
- acronis agent, cyber protect 15, cyber protect +2 moreSensitive information disclosure due to insecure registry permissions. The following products are...3.8 Low
- acronis agent, cyber protect 15, cyber protect +2 moreLocal privilege escalation due to insecure folder permissions. The following products are...7.3 High
- jenkins appspider, jenkins project appspider plugin +1 moreJenkins AppSpider Plugin missing permission check4.3 Medium
- jenkins project saml single sign on(sso) plugin, jenkins saml single sign-on +1 moreJenkins SAML Single Sign On(SSO) Plugin missing permission checks4.3 Medium
- storecommander scquickaccountingInsecure permissions in the ps_customer table of Prestashop scquickaccounting before v3.7.3...6.5 Medium
- intel setup and configuration softwareIncorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM...6.7 Medium
- intel uniteIncorrect default permissions in the software installer for Intel(R) Unite(R) Client software for...6.7 Medium
- intel nuc pro software suiteIncorrect default permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may...6.7 Medium
- intel nuc hdmi firmware update toolIncorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1...6.7 Medium
- intel virtual raid on cpuIncorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow...6.7 Medium
- intel nuc p14e laptop elementIncorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element...6.7 Medium
- intel nuc p14e laptop elementInsecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element...6.7 Medium
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura...5.5 Medium
- geovision gv-edge recording managerAn issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which...9.8 Critical
- f5 nginx api connectivity manager, nginx instance manager, nginx security monitoring +2 moreNGINX Management Suite vulnerability7.1 High
- codename065 download managerDownload Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure7.5 High
- nokia one-ndsIn Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be...8.8 High
- lenovo system updateA directory permissions management vulnerability in Lenovo System Update may allow elevation of...7.0 High
- obsidianAn issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop...6.5 Medium
- google androidIn retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This...7.8 High
- google androidIn applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local...5.5 Medium
- lenovo thinkagile hx1021 firmware, thinkagile hx1320 firmware, thinkagile hx1321 firmware +107 more +109 moreA valid XCC user's local account permissions overrides their active directory permissions under...7.3 High
- lenovo thinkagile hx1021 firmware, thinkagile hx1320 firmware, thinkagile hx1321 firmware +107 more +109 moreA valid, authenticated XCC user with read-only permissions can modify custom user roles on other...6.4 Medium
- sage 300On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer...7.8 High
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows...8.7 High
- Show moreLoading…