CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedCertain Draytek products are affected by Insecure Permissions. This affects AP903 v1.4.18 and...8.6 High
- No product listedInsecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0...7.8 High
- absolute secure accessPermissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.565.1 Medium
- absolute secure accessElevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.565.1 Medium
- absolute secure accessElevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.565.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory...7.5 High
- unitree go1 firmwareUnitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update...7.1 High
- aws client vpnLocal Privilege Escalation Vulnerability in AWS Client VPN Windows Client7.3 High
- mozilla firefox, thunderbird +1 moreIncorrect URL stripping in CSP reports9.8 Critical
- chainguard-dev melangemelange creates SBOM files in APKs with world-writable permissions4.4 Medium
- chainguard-dev apkoapko has incorrect permission (0666) in /etc/ld.so.cache and other files7.0 High
- lenovo elliptic human presence detection device driver for t14 gen 4 (type 21k3, 21k4), elliptic human presence detection device driver for t14 gen 5 (type 21ml, 21mm), elliptic human presence detection device driver for t14s gen 5 (type 21ls, 21lt) +30 more +32 moreAn incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that...8.5 High
- sophos intercept x for windows, intercept x for windows core agent +1 moreA vulnerability related to registry permissions in the Intercept X for Windows updater prior to...8.8 High
- jiransoft crosseditor4Stored-XSS possibility in Namo CrossEditor42.3 Low
- canonical multipassLPE on Multipass for macOS7.3 High
- phoenix contact axc f 1152, axc f 2152, axc f 3152 +2 more +4 morePhoenix Contact: DoS of the PLC due to incorrect default permissions possible6.5 Medium
- honor pc managerSeveral services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect...8.8 High
- nixos nixThe Nix, Lix, and Guix package managers default to using temporary build directories in a world...3.2 Low
- filebrowserFile Browser has Insecure File Permissions5.5 Medium
- hitachi energy microscada x sys600A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local...6.9 Medium
- notepad-plus-plusNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path7.3 High
- postboxTCC Bypass via Dylib Injection in Postbox4.8 Medium
- core.ai phoenix codeTCC Bypass via Dylib Injection in Phoenix Code4.8 Medium
- rapid7 velociraptorVelociraptor priviledge escalation via UpdateConfig artifact5.5 Medium
- conda-forge conda-smithyconda-smithy Has Incorrect Default File Permissions2.7 Low
- conda-forge conda-forge-webservicesconda-forge-webservices Privilege Escalation Risk via Default Docker Root User1.0 Low
- google chromeos, chrome os +1 moreChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits9.8 Critical
- tenable agent, nessus agent +1 moreLocal Privilege Escalation7.8 High
- motorola g34, g34t, g45 5g +2 moreAn incorrect default permissions vulnerability was reported in the MotoSignature application that...2.4 Low
- siemens energy servicesA vulnerability has been identified in Energy Services (All versions with G5DFR). Affected...9.5 Critical
- wasp-lang waspWasp has case insensitive OAuth ID vulnerability8.2 High
- acronis cyber protect cloud agentLocal privilege escalation due to insecure file permissions. The following products are affected:...6.7 Medium
- samsung wear os, samsung mobile devices +1 moreIncorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1...6.8 Medium
- 1panel-dev maxkbMaxKB Python Sandbox Bypass in Function Library5.8 Medium
- keiyo system co., ltd pc time tracerIncorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code...7.0 High
- samsung exynos 1480 firmware, exynos 2200 firmware, exynos 2400 firmware +2 moreAn issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free...7.8 High
- lenovo pc manager, pcmanager +1 moreAn improper default permissions vulnerability was reported in Lenovo PC Manager that could allow...8.5 High
- apple macosA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in...5.5 Medium
- blackmagic design davinci resolveTCC Bypass via Dylib Substitution in DaVinci Resolve4.8 Medium
- isc keaInsecure file permissions can result in confidential information leakage4.0 Medium
- sparklabs viscosityTCC Bypass via Dylib Loading in Viscosity.app4.8 Medium
- abb aspect-enterprise, matrix series, nexus series +2 moreInsecure Permissions6.9 Medium
- msp360 backupMSP360 Backup (for Windows) insecure filesystem permissions8.5 High
- poeditTCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app4.8 Medium
- makeplane planePlane has insecure permissions in UserSerializer3.5 Low
- No product listedIncorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18...5.4 Medium
screenAlpaquitaScreen creates by default world-writable PTYs5.1 Medium- No product listedIncorrect default permissions for some Endurance Gaming Mode software installers may allow an...5.4 Medium
- No product listedIncorrect default permissions for some Intel(R) Graphics Driver installers may allow an...5.4 Medium
- No product listedIncorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may...5.4 Medium
- Show moreLoading…