CWE-276 · Incorrect Default Permissions (page 12)
Page 12 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21737 | High | 7.5 | 2021-06-24 | A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could… |
CVE-2021-34395 | Low | 3.9 | 2021-06-22 | Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privilege… |
CVE-2021-34387 | Medium | 6.3 | 2021-06-21 | The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRAM reserved for Trus… |
CVE-2021-0143 | High | 7.8 | 2021-06-17 | Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable… |
CVE-2021-31998 | Medium | 6.8 | 2021-06-10 | A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2… |
CVE-2021-21736 | High | 7.2 | 2021-06-10 | A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end ap… |
CVE-2021-0106 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) Optane(TM) DC Persistent Memory for Windows software versions before 2.00.00.3842 or 1.00.00.3515 may allow an au… |
CVE-2021-0100 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the installer for the Intel(R) SSD Data Center Tool, versions downloaded before 12/31/2020, may allow an authenticated user to… |
CVE-2021-0058 | High | 7.8 | 2021-06-09 | Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially… |
CVE-2020-27384 | High | 7.8 | 2021-06-09 | The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to mo… |
CVE-2021-27032 | High | 7.8 | 2021-05-28 | Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools… |
CVE-2020-10145 | High | 7.8 | 2021-05-27 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, u… |
CVE-2021-33506 | High | 7.5 | 2021-05-26 | jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker to circumvent conf… |
CVE-2021-33038 | High | 7.5 | 2021-05-26 | An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archiv… |
CVE-2020-13599 | Low | 3.3 | 2021-05-25 | Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see htt… |
CVE-2020-9451 | Medium | 5.5 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissi… |
CVE-2020-9450 | High | 7.8 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged u… |
CVE-2020-28906 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are… |
CVE-2020-13667 | Medium | 5.3 | 2021-05-17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficien… |
CVE-2021-29052 | Medium | 4.3 | 2021-05-17 | The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.ge… |
CVE-2020-21342 | High | 7.5 | 2021-05-13 | Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. |
CVE-2021-31519 | High | 7.3 | 2021-05-12 | An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an at… |
CVE-2021-28649 | High | 7.3 | 2021-05-12 | An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker t… |
CVE-2021-25317 | Low | 3.3 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clo… |
CVE-2021-25319 | High | 7.8 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to… |
CVE-2021-26804 | Medium | 6.5 | 2021-05-04 | Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".g… |
CVE-2021-3451 | Medium | 5.5 | 2021-04-27 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-st… |
CVE-2021-28271 | High | 8.8 | 2021-04-27 | Soyal Technologies SOYAL 701Server 9.0.1 suffers from an elevation of privileges vulnerability which can be used by an authenticated user to change the executa… |
CVE-2021-20532 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure d… |
CVE-2021-0246 | High | 7.3 | 2021-04-22 | On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, devices using tenant services on Juniper Networks Junos OS, due to incorrect default perm… |
CVE-2021-0235 | High | 7.3 | 2021-04-22 | On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect… |
CVE-2020-27569 | High | 7.5 | 2021-04-21 | Arbitrary File Write exists in Aviatrix VPN Client 2.8.2 and earlier. The VPN service writes logs to a location that is world writable and can be leveraged to… |
CVE-2021-30494 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. Th… |
CVE-2021-30493 | Medium | 5.5 | 2021-04-14 | Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. The… |
CVE-2021-3462 | Medium | 5.5 | 2021-04-13 | A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the… |
CVE-2020-27228 | High | 7.8 | 2021-04-13 | An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privileg… |
CVE-2021-25381 | Medium | 5.5 | 2021-04-09 | Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attacker… |
CVE-2021-25359 | Medium | 4.0 | 2021-04-09 | An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted application… |
CVE-2021-25358 | Medium | 4.0 | 2021-04-09 | A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission… |
CVE-2020-13534 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 a… |
CVE-2020-13533 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with… |
CVE-2020-13532 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be repla… |
CVE-2021-22538 | Medium | 6.3 | 2021-03-31 | A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has… |
CVE-2021-27193 | Critical | 9.8 | 2021-03-25 | Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write… |
CVE-2021-25355 | Medium | 5.5 | 2021-03-25 | Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingI… |
CVE-2021-22311 | High | 7.2 | 2021-03-22 | There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher pri… |
CVE-2021-21438 | Low | 3.5 | 2021-03-22 | Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS versi… |
CVE-2020-4976 | Medium | 4.4 | 2021-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due… |
CVE-2021-0381 | Medium | 5.5 | 2021-03-10 | In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local info… |
CVE-2020-8357 | Medium | 5.5 | 2021-03-09 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-st… |
CVE-2021-24032 | Medium | 4.7 | 2021-03-04 | Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default perm… |
CVE-2021-24031 | Medium | 5.5 | 2021-03-04 | In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would… |
CVE-2020-13554 | High | 7.8 | 2021-03-03 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2020-22475 | Medium | 6.8 | 2021-02-22 | "Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application component allows arbitrary applications on a… |
CVE-2020-13549 | High | 7.8 | 2021-02-19 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory. Depending on the… |
CVE-2020-36233 | High | 7.8 | 2021-02-18 | The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 al… |
CVE-2020-13555 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server App… |
CVE-2020-13553 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2020-13552 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-13551 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-8765 | Medium | 6.7 | 2021-02-17 | Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2020-8701 | Medium | 6.7 | 2021-02-17 | Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation o… |
CVE-2020-0524 | Medium | 5.5 | 2021-02-17 | Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticate… |
CVE-2021-20653 | Medium | 5.3 | 2021-02-17 | Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to… |
CVE-2020-28392 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are c… |
CVE-2020-16144 | Medium | 5.7 | 2021-02-09 | When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user… |
CVE-2020-25245 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders a… |
CVE-2021-3394 | High | 8.8 | 2021-02-09 | Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for… |
CVE-2021-21436 | Low | 3.5 | 2021-02-08 | Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7… |
CVE-2020-29582 | Medium | 5.3 | 2021-02-03 | In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and… |
CVE-2020-25208 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions. |
CVE-2019-20468 | Critical | 9.8 | 2021-02-01 | An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, W… |
CVE-2020-26941 | Medium | 5.5 | 2021-01-26 | A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlin… |
CVE-2020-11997 | Medium | 4.3 | 2021-01-19 | Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the sa… |
CVE-2020-13922 | Medium | 6.5 | 2021-01-11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
CVE-2021-1056 | High | 7.1 | 2021-01-08 | NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operatin… |
CVE-2020-13452 | Critical | 9.8 | 2021-01-07 | In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to d… |
CVE-2020-29489 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the… |
CVE-2020-13541 | High | 8.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the… |
CVE-2020-13540 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 A… |
CVE-2020-13539 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911… |
CVE-2020-29492 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-29491 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-26031 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have… |
CVE-2020-13535 | High | 7.8 | 2020-12-18 | A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configurat… |
CVE-2020-0486 | High | 7.8 | 2020-12-15 | In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation… |
CVE-2020-5798 | High | 7.8 | 2020-12-07 | inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to impro… |
CVE-2020-13542 | High | 7.8 | 2020-12-03 | A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker c… |
CVE-2020-8539 | High | 7.8 | 2020-12-01 | Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, b… |
CVE-2020-11867 | Low | 3.3 | 2020-11-30 | Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to… |
CVE-2020-12510 | High | 7.3 | 2020-11-19 | The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirec… |
CVE-2020-13351 | Medium | 6.5 | 2020-11-17 | Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on… |
CVE-2020-24460 | Medium | 5.5 | 2020-11-12 | Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2020-24456 | High | 7.8 | 2020-11-12 | Incorrect default permissions in the Intel(R) Board ID Tool version v.1.01 may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2020-12346 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Battery Life Diagnostic Tool before version 1.0.7 may allow an authenticated user to potentially enable… |
CVE-2020-13770 | High | 7.8 | 2020-11-12 | Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services… |
CVE-2020-12354 | High | 7.8 | 2020-11-12 | Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escala… |
CVE-2020-12307 | High | 7.8 | 2020-11-12 | Improper permissions in some Intel(R) High Definition Audio drivers before version 9.21.00.4561 may allow an authenticated user to potentially enable escalatio… |
CVE-2020-12306 | High | 7.8 | 2020-11-12 | Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potent… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |