CWE-276 · Incorrect Default Permissions (page 11)
Page 11 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40049 | High | 7.5 | 2022-03-10 | There is a permission control vulnerability in the PMS module. Successful exploitation of this vulnerability can lead to sensitive system information being obt… |
CVE-2021-3981 | Low | 3.3 | 2022-03-10 | A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read… |
CVE-2021-32006 | Medium | 5.0 | 2022-03-10 | This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea Gate… |
CVE-2021-20269 | Medium | 5.5 | 2022-03-10 | A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal… |
CVE-2022-25943 | High | 7.8 | 2022-03-09 | The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is inst… |
CVE-2021-38268 | Medium | 6.5 | 2022-03-02 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10… |
CVE-2021-41652 | High | 7.5 | 2022-03-01 | Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database. |
CVE-2021-37103 | Medium | 5.5 | 2022-02-25 | There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2022-24343 | Medium | 4.3 | 2022-02-25 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. |
CVE-2022-24337 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. |
CVE-2022-25327 | Medium | 5.5 | 2022-02-25 | The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from… |
CVE-2022-23922 | Medium | 5.6 | 2022-02-24 | WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory an… |
CVE-2022-23104 | Medium | 5.6 | 2022-02-24 | WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace dir… |
CVE-2021-45083 | High | 7.1 | 2022-02-20 | An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be ex… |
CVE-2021-3948 | Medium | 6.3 | 2022-02-18 | An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migr… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |
CVE-2021-20001 | Critical | 9.8 | 2022-02-11 | It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the u… |
CVE-2022-23996 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable b… |
CVE-2022-23995 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2021-39658 | Critical | 9.8 | 2022-02-11 | ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller… |
CVE-2021-39635 | Critical | 9.1 | 2022-02-11 | ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissi… |
CVE-2020-14521 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use thi… |
CVE-2022-21204 | High | 7.8 | 2022-02-09 | Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2021-33166 | Medium | 5.5 | 2022-02-09 | Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated user to potentially enable information… |
CVE-2021-33129 | High | 7.8 | 2022-02-09 | Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable… |
CVE-2021-22817 | High | 7.8 | 2022-02-09 | A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privileg… |
CVE-2021-0093 | Medium | 4.4 | 2022-02-09 | Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local acce… |
CVE-2022-24113 | High | 7.8 | 2022-02-04 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) be… |
CVE-2022-24301 | Medium | 6.5 | 2022-02-02 | In Minetest before 5.4.0, players can add or subtract items from a different player's inventory. |
CVE-2021-46093 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php. |
CVE-2021-40416 | High | 8.8 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get… |
CVE-2021-40415 | Medium | 6.5 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check… |
CVE-2021-40414 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The SetMdAla… |
CVE-2021-40413 | High | 7.1 | 2022-01-28 | An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradeP… |
CVE-2021-40397 | High | 7.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system… |
CVE-2021-40396 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to… |
CVE-2021-40389 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the syste… |
CVE-2021-40388 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges… |
CVE-2021-41166 | Medium | 4.3 | 2022-01-26 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive… |
CVE-2021-46086 | High | 7.5 | 2022-01-25 | xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnera… |
CVE-2021-46085 | Medium | 6.5 | 2022-01-25 | OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority. |
CVE-2022-22296 | Medium | 5.3 | 2022-01-24 | Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply chan… |
CVE-2022-21704 | Medium | 5.5 | 2022-01-19 | log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders ar… |
CVE-2021-36781 | Medium | 5.9 | 2022-01-14 | A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients… |
CVE-2021-43860 | High | 8.2 | 2022-01-12 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissio… |
CVE-2021-45003 | Critical | 9.8 | 2022-01-10 | Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "im… |
CVE-2021-40004 | High | 7.5 | 2022-01-10 | The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2021-39967 | High | 7.5 | 2022-01-03 | There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of… |
CVE-2021-37132 | Medium | 5.3 | 2022-01-03 | PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-part… |
CVE-2021-45335 | High | 8.8 | 2021-12-27 | Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefor… |
CVE-2021-21912 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21911 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21910 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-44858 | High | 7.5 | 2021-12-20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=… |
CVE-2021-0979 | Medium | 5.5 | 2021-12-15 | In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create… |
CVE-2021-43326 | High | 7.8 | 2021-12-15 | Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. |
CVE-2021-43325 | High | 7.8 | 2021-12-15 | Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression. |
CVE-2021-44833 | Critical | 9.8 | 2021-12-12 | The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. |
CVE-2021-21957 | High | 7.3 | 2021-12-08 | A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command i… |
CVE-2021-42711 | High | 7.8 | 2021-12-01 | Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges wh… |
CVE-2021-31822 | High | 7.8 | 2021-11-24 | When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged… |
CVE-2021-44140 | Critical | 9.1 | 2021-11-24 | Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logou… |
CVE-2021-37030 | High | 7.5 | 2021-11-23 | There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-33071 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially e… |
CVE-2021-33062 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentia… |
CVE-2021-0065 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to po… |
CVE-2020-8741 | High | 7.8 | 2021-11-17 | Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially… |
CVE-2021-33092 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authentic… |
CVE-2021-33090 | High | 7.8 | 2021-11-17 | Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2… |
CVE-2021-33088 | High | 7.8 | 2021-11-17 | Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an aut… |
CVE-2021-3720 | Medium | 5.5 | 2021-11-12 | An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could a… |
CVE-2021-43199 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
CVE-2021-38420 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacke… |
CVE-2021-3579 | High | 7.8 | 2021-10-28 | Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for W… |
CVE-2021-36990 | Critical | 9.8 | 2021-10-28 | There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions. |
CVE-2021-36989 | Critical | 9.8 | 2021-10-28 | There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions. |
CVE-2021-22475 | Medium | 5.3 | 2021-10-28 | There is an Improper permission management vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-38379 | Medium | 5.5 | 2021-10-27 | The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. |
CVE-2021-37363 | High | 7.8 | 2021-10-26 | An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and repla… |
CVE-2021-42011 | High | 7.8 | 2021-10-21 | An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated pr… |
CVE-2021-40123 | Medium | 4.3 | 2021-10-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative… |
CVE-2021-42055 | Medium | 6.8 | 2021-10-18 | ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker. |
CVE-2021-42098 | High | 8.8 | 2021-10-18 | An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerS… |
CVE-2021-29005 | High | 8.8 | 2021-10-11 | Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may… |
CVE-2021-39886 | Low | 2.6 | 2021-10-05 | Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing u… |
CVE-2021-33923 | Medium | 5.5 | 2021-09-29 | Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys… |
CVE-2021-36365 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. |
CVE-2021-36363 | Critical | 9.8 | 2021-09-28 | Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. |
CVE-2021-20037 | High | 7.8 | 2021-09-21 | SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentiall… |
CVE-2021-1832 | Medium | 5.5 | 2021-09-08 | Copied files may not have the expected file permissions. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS… |
CVE-2021-1831 | Medium | 5.5 | 2021-09-08 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restrict… |
CVE-2021-30750 | Medium | 5.5 | 2021-09-08 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3. A malicious application may be able to access the user's re… |
CVE-2021-31007 | Medium | 5.5 | 2021-08-24 | Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.1 and iPadOS 15.1, tvOS 15.1, macOS Big Sur 11.6.2, watc… |
CVE-2021-31006 | Medium | 5.5 | 2021-08-24 | Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 7.6, tvOS 14.7, macOS Big Sur 11.5. A malicious applica… |
CVE-2021-31000 | Low | 3.3 | 2021-08-24 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1, tvOS 15.2. A mal… |
CVE-2021-30999 | Medium | 4.3 | 2021-08-24 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.6 and iPadOS 14.6. A user may be unable to fully delete browsing history. |
CVE-2021-39274 | Critical | 9.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main… |
CVE-2021-39273 | High | 8.8 | 2021-08-19 | In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the applicat… |
CVE-2021-37351 | Medium | 5.3 | 2021-08-13 | Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to… |
CVE-2021-35312 | High | 7.8 | 2021-08-06 | A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, all… |