CWE-276 · Incorrect Default Permissions (page 12)
Page 12 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36795 | High | 7.8 | 2021-08-06 | A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivilege… |
CVE-2021-22295 | Medium | 5.5 | 2021-08-06 | A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page… |
CVE-2021-32464 | High | 7.8 | 2021-08-04 | An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services… |
CVE-2021-33334 | Medium | 4.3 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack… |
CVE-2021-33333 | Medium | 6.3 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does… |
CVE-2021-33327 | Medium | 4.3 | 2021-08-03 | The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8… |
CVE-2021-33324 | Medium | 4.3 | 2021-08-03 | The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission… |
CVE-2020-5353 | High | 8.8 | 2021-07-29 | The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access… |
CVE-2020-26180 | Medium | 6.3 | 2021-07-28 | Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport use… |
CVE-2020-29503 | Medium | 4.1 | 2021-07-19 | Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vu… |
CVE-2020-25593 | Medium | 6.7 | 2021-07-15 | Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. |
CVE-2021-0486 | High | 7.8 | 2021-07-14 | In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local… |
CVE-2021-0441 | High | 7.3 | 2021-07-14 | In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no add… |
CVE-2021-31217 | Critical | 9.1 | 2021-07-13 | In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. |
CVE-2021-32725 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being r… |
CVE-2021-33214 | Medium | 6.1 | 2021-07-09 | In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure… |
CVE-2021-26274 | High | 7.1 | 2021-07-07 | The Agent in NinjaRMM 5.0.909 has Insecure Permissions. |
CVE-2021-22346 | Medium | 5.3 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to the disclosure of user… |
CVE-2021-22368 | High | 7.5 | 2021-06-30 | There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device. |
CVE-2021-22371 | High | 7.5 | 2021-06-30 | There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-20490 | Medium | 5.5 | 2021-06-29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID… |
CVE-2021-21737 | High | 7.5 | 2021-06-24 | A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could… |
CVE-2021-34395 | Low | 3.9 | 2021-06-22 | Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privilege… |
CVE-2021-34387 | Medium | 6.3 | 2021-06-21 | The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRAM reserved for Trus… |
CVE-2021-0143 | High | 7.8 | 2021-06-17 | Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable… |
CVE-2021-31998 | Medium | 6.8 | 2021-06-10 | A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2… |
CVE-2021-21736 | High | 7.2 | 2021-06-10 | A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end ap… |
CVE-2021-0106 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) Optane(TM) DC Persistent Memory for Windows software versions before 2.00.00.3842 or 1.00.00.3515 may allow an au… |
CVE-2021-0100 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the installer for the Intel(R) SSD Data Center Tool, versions downloaded before 12/31/2020, may allow an authenticated user to… |
CVE-2021-0058 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially… |
CVE-2020-27384 | High | 7.8 | 2021-06-09 | The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to mo… |
CVE-2021-27032 | High | 7.8 | 2021-05-28 | Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools… |
CVE-2020-10145 | High | 7.8 | 2021-05-27 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, u… |
CVE-2021-33506 | High | 7.5 | 2021-05-26 | jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conf… |
CVE-2021-33038 | High | 7.5 | 2021-05-26 | An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archiv… |
CVE-2020-13599 | Low | 3.3 | 2021-05-25 | Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see htt… |
CVE-2020-9451 | Medium | 5.5 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissi… |
CVE-2020-9450 | High | 7.8 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged u… |
CVE-2020-28906 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are… |
CVE-2020-13667 | Medium | 5.3 | 2021-05-17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficien… |
CVE-2021-29052 | Medium | 4.3 | 2021-05-17 | The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.ge… |
CVE-2020-21342 | High | 7.5 | 2021-05-13 | Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. |
CVE-2021-31519 | High | 7.3 | 2021-05-12 | An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an at… |
CVE-2021-28649 | High | 7.3 | 2021-05-12 | An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker t… |
CVE-2021-25317 | Low | 3.3 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clo… |
CVE-2021-25319 | High | 7.8 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to… |
CVE-2021-26804 | Medium | 6.5 | 2021-05-04 | Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".g… |
CVE-2021-3451 | Medium | 5.5 | 2021-04-27 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-st… |
CVE-2021-28271 | High | 8.8 | 2021-04-27 | Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executa… |
CVE-2021-20532 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure d… |
CVE-2021-0246 | High | 7.3 | 2021-04-22 | On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, devices using tenant services on Juniper Networks Junos OS, due to incorrect default perm… |
CVE-2021-0235 | High | 7.3 | 2021-04-22 | On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect… |
CVE-2020-27569 | High | 7.5 | 2021-04-21 | Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to… |
CVE-2021-30494 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. Th… |
CVE-2021-30493 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. The… |
CVE-2021-3462 | Medium | 5.5 | 2021-04-13 | A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the… |
CVE-2020-27228 | High | 7.8 | 2021-04-13 | An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privileg… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |
CVE-2021-25359 | Medium | 4.0 | 2021-04-09 | An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted application… |
CVE-2021-25358 | Medium | 4.0 | 2021-04-09 | A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission… |
CVE-2020-13534 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 a… |
CVE-2020-13533 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with… |
CVE-2020-13532 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be repla… |
CVE-2021-22538 | Medium | 6.3 | 2021-03-31 | A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has… |
CVE-2021-27193 | Critical | 9.8 | 2021-03-25 | Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write… |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-22311 | High | 7.2 | 2021-03-22 | There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher pri… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2020-4976 | Medium | 4.4 | 2021-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due… |
CVE-2021-0381 | Medium | 5.5 | 2021-03-10 | In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local info… |
CVE-2020-8357 | Medium | 5.5 | 2021-03-09 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-st… |
CVE-2021-24032 | Medium | 4.7 | 2021-03-04 | Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default perm… |
CVE-2021-24031 | Medium | 5.5 | 2021-03-04 | In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would… |
CVE-2020-13554 | High | 7.8 | 2021-03-03 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2020-22475 | Medium | 6.8 | 2021-02-22 | "Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application component allows arbitrary applications on a… |
CVE-2020-13549 | High | 7.8 | 2021-02-19 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory. Depending on the… |
CVE-2020-36233 | High | 7.8 | 2021-02-18 | The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 al… |
CVE-2020-13555 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server App… |
CVE-2020-13553 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2020-13552 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-13551 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-8765 | Medium | 6.7 | 2021-02-17 | Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2020-8701 | Medium | 6.7 | 2021-02-17 | Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation o… |
CVE-2020-0524 | Medium | 5.5 | 2021-02-17 | Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticate… |
CVE-2021-20653 | Medium | 5.3 | 2021-02-17 | Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to… |
CVE-2020-28392 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are c… |
CVE-2020-16144 | Medium | 5.7 | 2021-02-09 | When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user… |
CVE-2020-25245 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders a… |
CVE-2021-3394 | High | 8.8 | 2021-02-09 | Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2020-29582 | Medium | 5.3 | 2021-02-03 | In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and… |
CVE-2020-25208 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions. |
CVE-2019-20468 | Critical | 9.8 | 2021-02-01 | An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, W… |
CVE-2020-26941 | Medium | 5.5 | 2021-01-26 | A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlin… |
CVE-2020-11997 | Medium | 4.3 | 2021-01-19 | Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the sa… |
CVE-2020-13922 | Medium | 6.5 | 2021-01-11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
CVE-2021-1056 | High | 7.1 | 2021-01-08 | NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operatin… |
CVE-2020-13452 | Critical | 9.8 | 2021-01-07 | In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to d… |
CVE-2020-29489 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the… |
CVE-2020-13541 | High | 8.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the… |