CWE-276 · Incorrect Default Permissions (page 11)
Page 11 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14521 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use thi… |
CVE-2022-21204 | High | 7.8 | 2022-02-09 | Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2021-33166 | Medium | 5.5 | 2022-02-09 | Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated user to potentially enable information… |
CVE-2021-33129 | High | 7.8 | 2022-02-09 | Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable… |
CVE-2021-22817 | High | 7.8 | 2022-02-09 | A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privileg… |
CVE-2021-0093 | Medium | 4.4 | 2022-02-09 | Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local acce… |
CVE-2022-24113 | High | 7.8 | 2022-02-04 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) be… |
CVE-2022-24301 | Medium | 6.5 | 2022-02-02 | In Minetest before 5.4.0, players can add or subtract items from a different player's inventory. |
CVE-2021-46093 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php. |
CVE-2021-40416 | High | 8.8 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get… |
CVE-2021-40415 | Medium | 6.5 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check… |
CVE-2021-40414 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAla… |
CVE-2021-40413 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradeP… |
CVE-2021-40397 | High | 7.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system… |
CVE-2021-40396 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to… |
CVE-2021-40389 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the syste… |
CVE-2021-40388 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges… |
CVE-2021-41166 | Medium | 4.3 | 2022-01-26 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive… |
CVE-2021-46086 | High | 7.5 | 2022-01-25 | xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnera… |
CVE-2021-46085 | Medium | 6.5 | 2022-01-25 | OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority. |
CVE-2022-22296 | Medium | 5.3 | 2022-01-24 | Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply chan… |
CVE-2022-21704 | Medium | 5.5 | 2022-01-19 | log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders ar… |
CVE-2021-36781 | Medium | 5.9 | 2022-01-14 | A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients… |
CVE-2021-43860 | High | 8.2 | 2022-01-12 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissio… |
CVE-2021-45003 | Critical | 9.8 | 2022-01-10 | Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "im… |
CVE-2021-40004 | High | 7.5 | 2022-01-10 | The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-39967 | High | 7.5 | 2022-01-03 | There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of… |
CVE-2021-37132 | Medium | 5.3 | 2022-01-03 | PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-part… |
CVE-2021-45335 | High | 8.8 | 2021-12-27 | Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefor… |
CVE-2021-21912 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21911 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21910 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-44858 | High | 7.5 | 2021-12-20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=… |
CVE-2021-0979 | Medium | 5.5 | 2021-12-15 | In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create… |
CVE-2021-43326 | High | 7.8 | 2021-12-15 | Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. |
CVE-2021-43325 | High | 7.8 | 2021-12-15 | Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression. |
CVE-2021-44833 | Critical | 9.8 | 2021-12-12 | The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. |
CVE-2021-21957 | High | 7.3 | 2021-12-08 | A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command i… |
CVE-2021-42711 | High | 7.8 | 2021-12-01 | Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges wh… |
CVE-2021-31822 | High | 7.8 | 2021-11-24 | When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged… |
CVE-2021-44140 | Critical | 9.1 | 2021-11-24 | Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logou… |
CVE-2021-37030 | High | 7.5 | 2021-11-23 | There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-33071 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially e… |
CVE-2021-33062 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentia… |
CVE-2021-0065 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to po… |
CVE-2020-8741 | High | 7.8 | 2021-11-17 | Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially… |
CVE-2021-33092 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authentic… |
CVE-2021-33090 | High | 7.8 | 2021-11-17 | Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2… |
CVE-2021-33088 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an aut… |
CVE-2021-3720 | Medium | 5.5 | 2021-11-12 | An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could a… |
CVE-2021-43199 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
CVE-2021-38420 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacke… |
CVE-2021-3579 | High | 7.8 | 2021-10-28 | Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for W… |
CVE-2021-36990 | Critical | 9.8 | 2021-10-28 | There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions. |
CVE-2021-36989 | Critical | 9.8 | 2021-10-28 | There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions. |
CVE-2021-22475 | Medium | 5.3 | 2021-10-28 | There is an Improper permission management vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-38379 | Medium | 5.5 | 2021-10-27 | The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. |
CVE-2021-37363 | High | 7.8 | 2021-10-26 | An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and repla… |
CVE-2021-42011 | High | 7.8 | 2021-10-21 | An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated pr… |
CVE-2021-40123 | Medium | 4.3 | 2021-10-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative… |
CVE-2021-42055 | Medium | 6.8 | 2021-10-18 | ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker. |
CVE-2021-42098 | High | 8.8 | 2021-10-18 | An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerS… |
CVE-2021-29005 | High | 8.8 | 2021-10-11 | Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may… |
CVE-2021-39886 | Low | 2.6 | 2021-10-05 | Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing u… |
CVE-2021-33923 | Medium | 5.5 | 2021-09-29 | Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys… |
CVE-2021-36365 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. |
CVE-2021-36363 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. |
CVE-2021-20037 | High | 7.8 | 2021-09-21 | SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentiall… |
CVE-2021-1832 | Medium | 5.5 | 2021-09-08 | Copied files may not have the expected file permissions. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS… |
CVE-2021-1831 | Medium | 5.5 | 2021-09-08 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restrict… |
CVE-2021-30750 | Medium | 5.5 | 2021-09-08 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3. A malicious application may be able to access the user's re… |
CVE-2021-31007 | Medium | 5.5 | 2021-08-24 | Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.1 and iPadOS 15.1, tvOS 15.1, macOS Big Sur 11.6.2, watc… |
CVE-2021-31006 | Medium | 5.5 | 2021-08-24 | Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 7.6, tvOS 14.7, macOS Big Sur 11.5. A malicious applica… |
CVE-2021-31000 | Low | 3.3 | 2021-08-24 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1, tvOS 15.2. A mal… |
CVE-2021-30999 | Medium | 4.3 | 2021-08-24 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.6 and iPadOS 14.6. A user may be unable to fully delete browsing history. |
CVE-2021-39274 | Critical | 9.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main… |
CVE-2021-39273 | High | 8.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the applicat… |
CVE-2021-37351 | Medium | 5.3 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to… |
CVE-2021-35312 | High | 7.8 | 2021-08-06 | A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, all… |
CVE-2021-36795 | High | 7.8 | 2021-08-06 | A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivilege… |
CVE-2021-22295 | Medium | 5.5 | 2021-08-06 | A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page… |
CVE-2021-32464 | High | 7.8 | 2021-08-04 | An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services… |
CVE-2021-33334 | Medium | 4.3 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack… |
CVE-2021-33333 | Medium | 6.3 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does… |
CVE-2021-33327 | Medium | 4.3 | 2021-08-03 | The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8… |
CVE-2021-33324 | Medium | 4.3 | 2021-08-03 | The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission… |
CVE-2020-5353 | High | 8.8 | 2021-07-29 | The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access… |
CVE-2020-26180 | Medium | 6.3 | 2021-07-28 | Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport use… |
CVE-2020-29503 | Medium | 4.1 | 2021-07-19 | Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vu… |
CVE-2020-25593 | Medium | 6.7 | 2021-07-15 | Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. |
CVE-2021-0486 | High | 7.8 | 2021-07-14 | In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local… |
CVE-2021-0441 | High | 7.3 | 2021-07-14 | In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no add… |
CVE-2021-31217 | Critical | 9.1 | 2021-07-13 | In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. |
CVE-2021-32725 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being r… |
CVE-2021-33214 | Medium | 6.1 | 2021-07-09 | In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure… |
CVE-2021-26274 | High | 7.1 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Insecure Permissions. |
CVE-2021-22346 | Medium | 5.3 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to the disclosure of user… |
CVE-2021-22368 | High | 7.5 | 2021-06-30 | There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device. |
CVE-2021-22371 | High | 7.5 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-20490 | Medium | 5.5 | 2021-06-29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID… |