CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- huawei emui, harmonyos +1 morePermission verification bypass vulnerability in the notification module Impact: Successful...8.4 High
- spotipy-dev spotipySpotipy's cache file, containing spotify auth token, is created with overly broad permissions8.4 High
- No product listedIn Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an...9.8 Critical
- dell recoverpoint for vms, recoverpoint for virtual machines +1 moreDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission...5.5 Medium
- No product listedIncorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19...5.4 Medium
- No product listedIncorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software...5.4 Medium
- mayswind ezbookkeepingMaysWind ezBookkeeping has Improper Privilege Management9.8 Critical
- No product listedAn issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the...7.8 High
- amd aim-t(amd integrated management technology) softwareIncorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability...7.3 High
- jrohy trojanAn issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via...9.8 Critical
- omnissa horizon client for macosOmnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to...7.8 High
- No product listedPolycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies....7.5 High
- dumbwareio dumbdropDumb Drop has an arbitrary file overwrite and path traversal for root shell9.7 Critical
- sonicwall netextenderA vulnerability in the NetExtender Windows client log export function allows unauthorized access...5.5 Medium
- snowflake connector, snowflakedb snowflake-connector-python +1 moreThe Snowflake Connector for Python uses insecure cache files permissions4.4 Medium
- snowflake connector, snowflakedb snowflake-connector-net +1 moreSnowflake Connector for .NET has weak temporary files permissions5.0 Medium
- snowflake jdbc, snowflakedb snowflake-jdbc +1 moreSnowflake JDBC uses insecure temporary credential cache file permissions4.4 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Quarantine Microworld default permission4.8 Medium
- ruoyiRuoYi has insecure permissions5.4 Medium
- acronis snap deployLocal privilege escalation due to insecure folder permissions. The following products are...6.7 Medium
- apple ipados, macos, tvos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.8 High
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura...7.1 High
- apple macosThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia...5.3 Medium
- apple macosThis issue was addressed with improved message validation. This issue is fixed in macOS Sequoia...7.8 High
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS...7.7 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...9.8 Critical
- apple ipados, macos, tvos +5 more +7 moreA use after free issue was addressed with improved memory management. This issue is fixed in...10.0 Critical
- cmsimpleCMSimple 5.16 allows the user to edit log.php file via print page.9.1 Critical
- g data cyberdefense ag data security clientG DATA Security Client Local privilege escalation8.5 High
- g data cyberdefense ag data management serverG DATA Management Server Local privilege escalation7.3 High
- xerox workplace suiteWeak default folder permissions6.7 Medium
- jenkins eiffel broadcaster, jenkins project eiffel broadcaster plugin +1 moreCache confusion in Jenkins Eiffel Broadcaster Plugin4.3 Medium
- jenkins openid connect authentication, jenkins project openid connect authentication plugin +1 moreImproper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin8.8 High
- cisco meeting managementCisco Meeting Management Client-Server Privilege Escalation Vulnerability9.9 Critical
- No product listedIn Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control...7.8 High
- google androidIn setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content...7.8 High
- oracle analytics desktopVulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). ...7.8 High
- No product listedNorthern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.9.1 Critical
- google androidIn many locations, there is a possible way to access kernel memory in user space due to an...7.8 High
- google androidIn multiple functions of Parcel.cpp, there is a possible way to bypass address space layout...7.8 High
- wegiaWeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application...9.8 Critical
- dlink dir-816 firmwareAn access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210...9.8 Critical
- themesbrand chatviaInsecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to...4.6 Medium
- No product listedInsecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c...5.1 Medium
- ibm openpages, openpages with watson +1 moreIBM OpenPages information disclosure5.4 Medium
- pgadminPgadmin: users authenticated simultaneously via ldap may be attached to the wrong session8.0 High
- avast antivirusREVE Antivirus reveinstall default permission8.5 High
- dani-garcia vaultwardenVaultwarden vulnerable to user impersonation9.8 Critical
- No product listedInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client...9.1 Critical
- No product listedIn PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user...7.8 High
- Show moreLoading…