CWE-276 · Incorrect Default Permissions (page 10)
Page 10 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38764 | High | 7.8 | 2022-09-19 | A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder o… |
CVE-2022-38466 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions… |
CVE-2022-2528 | Medium | 6.5 | 2022-09-09 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. |
CVE-2022-31251 | Medium | 6.5 | 2022-09-07 | A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm us… |
CVE-2022-2735 | High | 7.8 | 2022-09-06 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemo… |
CVE-2022-40109 | Critical | 9.8 | 2022-09-06 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions via binary /bin/boa. |
CVE-2022-36640 | Critical | 9.8 | 2022-09-02 | influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: th… |
CVE-2022-32743 | High | 7.5 | 2022-09-01 | Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. |
CVE-2022-37173 | High | 7.8 | 2022-08-30 | An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. |
CVE-2022-0336 | High | 8.8 | 2022-08-29 | The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database… |
CVE-2021-3917 | Medium | 5.5 | 2022-08-23 | A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a l… |
CVE-2021-3701 | Medium | 6.6 | 2022-08-23 | A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an att… |
CVE-2021-37289 | High | 7.2 | 2022-08-22 | Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.as… |
CVE-2022-27500 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information di… |
CVE-2022-26344 | High | 7.8 | 2022-08-18 | Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of… |
CVE-2022-25899 | Critical | 9.8 | 2022-08-18 | Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to poten… |
CVE-2021-44470 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentially enable informa… |
CVE-2021-39087 | Medium | 6.5 | 2022-08-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to… |
CVE-2021-30490 | High | 7.8 | 2022-08-16 | upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to… |
CVE-2022-20272 | Medium | 5.5 | 2022-08-12 | In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text. This could lead to loc… |
CVE-2022-20246 | High | 7.8 | 2022-08-11 | In WindowManager, there is a possible bypass of the restrictions for starting activities from the background due to an incorrect UID/permission check. This cou… |
CVE-2022-37006 | High | 7.5 | 2022-08-10 | Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service availability. |
CVE-2022-37003 | Critical | 9.8 | 2022-08-10 | The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized acc… |
CVE-2022-37030 | High | 7.8 | 2022-08-04 | Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox grou… |
CVE-2022-22424 | Medium | 5.5 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from the TLS key file due to incorrect file permissions. IBM X-Force… |
CVE-2022-34737 | Critical | 9.1 | 2022-07-12 | The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confi… |
CVE-2022-30758 | Medium | 4.0 | 2022-07-12 | Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected information with privilege of… |
CVE-2022-30753 | Low | 3.3 | 2022-07-12 | Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device ID without permissio… |
CVE-2022-2366 | Medium | 5.6 | 2022-07-12 | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place o… |
CVE-2022-32207 | Critical | 9.8 | 2022-07-07 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporar… |
CVE-2022-33996 | High | 8.8 | 2022-07-07 | Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous u… |
CVE-2022-2270 | Low | 3.5 | 2022-07-01 | An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions st… |
CVE-2022-33023 | High | 7.5 | 2022-06-29 | CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong. |
CVE-2021-41637 | High | 7.1 | 2022-06-24 | Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other inf… |
CVE-2021-41635 | High | 8.8 | 2022-06-24 | When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities w… |
CVE-2022-1833 | High | 8.8 | 2022-06-21 | A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Oper… |
CVE-2022-33912 | High | 7.8 | 2022-06-17 | A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions onl… |
CVE-2022-31072 | Low | 2.5 | 2022-06-15 | Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the… |
CVE-2022-31071 | Low | 2.5 | 2022-06-15 | Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem w… |
CVE-2022-32562 | High | 8.8 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission. |
CVE-2021-46811 | Medium | 5.3 | 2022-06-13 | HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause disclosure of the Card Production Life Cyc… |
CVE-2022-25804 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\… |
CVE-2022-30747 | Medium | 5.5 | 2022-06-07 | PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent. |
CVE-2022-31500 | High | 7.8 | 2022-06-02 | In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. |
CVE-2022-29483 | High | 7.8 | 2022-06-02 | Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confident… |
CVE-2022-28702 | Medium | 6.1 | 2022-06-02 | Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confident… |
CVE-2022-29376 | High | 8.8 | 2022-05-23 | Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute arbitrary code via o… |
CVE-2022-28999 | High | 8.8 | 2022-05-23 | Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.e… |
CVE-2022-28932 | Critical | 9.8 | 2022-05-23 | D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions. |
CVE-2022-29178 | High | 8.8 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16… |
CVE-2022-29162 | Medium | 5.9 | 2022-05-17 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc… |
CVE-2022-0997 | Low | 3.9 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative… |
CVE-2022-0486 | Medium | 4.4 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, admini… |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2022-30375 | Medium | 6.5 | 2022-05-13 | Sourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes/Master.php?f=delete_img. |
CVE-2022-30367 | Medium | 6.5 | 2022-05-13 | Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img. |
CVE-2022-23802 | High | 7.5 | 2022-05-06 | Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private inf… |
CVE-2022-29585 | High | 7.5 | 2022-04-28 | In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown… |
CVE-2022-28218 | Medium | 5.5 | 2022-04-26 | An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys (found in a Roundcube configuration file… |
CVE-2021-3722 | Medium | 5.0 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-stand… |
CVE-2022-20732 | High | 7.8 | 2022-04-21 | A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access… |
CVE-2022-29547 | High | 7.5 | 2022-04-21 | The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead… |
CVE-2021-43986 | Medium | 6.0 | 2022-04-20 | The setup program for the affected product configures its files and folders with full access, which may allow unauthorized users permission to replace original… |
CVE-2022-26595 | Medium | 4.3 | 2022-04-19 | Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of si… |
CVE-2022-27652 | Medium | 5.3 | 2022-04-18 | A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) wher… |
CVE-2011-1762 | Medium | 6.5 | 2022-04-18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user wi… |
CVE-2021-39794 | High | 7.8 | 2022-04-12 | In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing per… |
CVE-2022-27840 | Medium | 4.4 | 2022-04-11 | Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permissio… |
CVE-2022-24804 | Medium | 5.3 | 2022-04-11 | Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups… |
CVE-2022-27960 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' per… |
CVE-2022-27958 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitrarily modify users'… |
CVE-2022-26855 | Medium | 5.5 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this v… |
CVE-2022-22518 | Medium | 6.5 | 2022-04-07 | A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the appl… |
CVE-2022-27651 | Medium | 6.8 | 2022-04-04 | A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where contain… |
CVE-2022-27650 | High | 7.5 | 2022-04-04 | A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where… |
CVE-2022-27649 | High | 7.5 | 2022-04-04 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), wh… |
CVE-2021-39780 | High | 7.8 | 2022-03-30 | In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to loc… |
CVE-2021-39779 | Medium | 5.5 | 2022-03-30 | In getCallStateUsingPackage of Telecom Service, there is a missing permission check. This could lead to local information disclosure of the call state with no… |
CVE-2021-39770 | Medium | 5.5 | 2022-03-30 | In Framework, there is a possible disclosure of the device owner package due to a missing permission check. This could lead to local information disclosure wit… |
CVE-2021-39769 | Medium | 5.5 | 2022-03-30 | In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could le… |
CVE-2021-39748 | Medium | 5.5 | 2022-03-30 | In InputMethodEditor, there is a possible way to access some files accessible to Settings due to an unsafe PendingIntent. This could lead to local information… |
CVE-2021-39747 | Medium | 5.5 | 2022-03-30 | In Settings Provider, there is a possible way to list values of non-readable global settings due to a permissions bypass. This could lead to local information… |
CVE-2021-1033 | High | 7.8 | 2022-03-30 | In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to loca… |
CVE-2021-1000 | High | 7.8 | 2022-03-30 | In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to l… |
CVE-2022-22948 | Medium | 6.5 | 2022-03-29 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to th… |
CVE-2022-26839 | High | 7.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow… |
CVE-2021-40904 | High | 8.8 | 2022-03-25 | The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which all… |
CVE-2021-44905 | High | 8.2 | 2022-03-25 | Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthen… |
CVE-2022-27919 | Critical | 9.8 | 2022-03-25 | Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allow… |
CVE-2021-44751 | Medium | 4.3 | 2022-03-25 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger diale… |
CVE-2022-25570 | Medium | 6.5 | 2022-03-21 | In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifi… |
CVE-2021-22571 | Medium | 5.5 | 2022-03-18 | A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery… |
CVE-2022-25364 | High | 8.1 | 2022-03-17 | In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malici… |
CVE-2021-39694 | High | 7.8 | 2022-03-16 | In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user due to a permissions bypass. This could… |
CVE-2022-25815 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without perm… |
CVE-2022-25814 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action witho… |
CVE-2021-44216 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache… |
CVE-2021-44215 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact. |
CVE-2021-40059 | Medium | 6.5 | 2022-03-10 | There is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2021-40053 | Critical | 9.1 | 2022-03-10 | There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity. |