CWE-276 · Incorrect Default Permissions (page 13)
Page 13 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-24402 | Medium | 4.9 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could… |
CVE-2020-13537 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-13536 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-28044 | Medium | 6.8 | 2020-11-02 | An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and… |
CVE-2020-28041 | Medium | 6.5 | 2020-11-02 | The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a… |
CVE-2020-27358 | Medium | 4.3 | 2020-11-02 | An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) all… |
CVE-2019-8777 | Low | 2.4 | 2020-10-27 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave… |
CVE-2019-14718 | Medium | 6.7 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privil… |
CVE-2020-27665 | High | 7.5 | 2020-10-22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. |
CVE-2020-17381 | High | 7.3 | 2020-10-21 | An issue was discovered in Ghisler Total Commander 9.51. Due to insufficient access restrictions in the default installation directory, an attacker can elevate… |
CVE-2020-15843 | High | 7.3 | 2020-09-24 | ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveF… |
CVE-2020-15850 | High | 7.8 | 2020-09-24 | Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and ga… |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-0294 | Medium | 5.5 | 2020-09-18 | In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local… |
CVE-2020-0374 | High | 7.8 | 2020-09-17 | In NFC, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges n… |
CVE-2020-0275 | High | 7.8 | 2020-09-17 | In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permissions bypass. This c… |
CVE-2020-0390 | Medium | 5.5 | 2020-09-17 | In the app zygote SE Policy, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges ne… |
CVE-2020-0388 | High | 7.8 | 2020-09-17 | In createEmergencyLocationUserNotification of GnssVisibilityControl.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This co… |
CVE-2020-8346 | Medium | 5.5 | 2020-09-15 | A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could a… |
CVE-2020-10050 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application… |
CVE-2020-10049 | High | 7.3 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected applicat… |
CVE-2019-10679 | High | 7.8 | 2020-09-03 | Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissi… |
CVE-2020-23971 | High | 7.5 | 2020-09-01 | gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload function without authenticating to the appli… |
CVE-2020-24584 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of… |
CVE-2020-24583 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode… |
CVE-2020-7527 | High | 7.8 | 2020-08-31 | Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full access control to loca… |
CVE-2020-13468 | Medium | 6.8 | 2020-08-31 | Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding wires (which have… |
CVE-2020-24717 | High | 7.8 | 2020-08-27 | OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. |
CVE-2020-3485 | Medium | 6.3 | 2020-08-26 | A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an au… |
CVE-2020-3484 | Medium | 5.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentia… |
CVE-2020-3152 | Medium | 6.7 | 2020-08-26 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary c… |
CVE-2020-7824 | Medium | 6.5 | 2020-08-25 | A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability… |
CVE-2020-1571 | High | 7.3 | 2020-08-17 | An elevation of privilege vulnerability exists in Windows Setup in the way it handles permissions. A locally authenticated attacker could run arbitrary code wi… |
CVE-2020-15145 | Medium | 6.7 | 2020-08-14 | In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the followi… |
CVE-2020-8763 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enab… |
CVE-2020-8743 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) Mailbox Interface driver, all versions, may allow an authenticated user to potentially enable escalation… |
CVE-2020-12287 | High | 7.8 | 2020-08-13 | Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalati… |
CVE-2020-15821 | Medium | 6.5 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. |
CVE-2020-8026 | High | 8.4 | 2020-08-07 | A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers wit… |
CVE-2020-8219 | High | 7.2 | 2020-07-30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator. |
CVE-2020-2077 | High | 7.5 | 2020-07-29 | SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker coul… |
CVE-2020-10606 | High | 7.8 | 2020-07-24 | In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation c… |
CVE-2020-6527 | Medium | 4.3 | 2020-07-22 | Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML pa… |
CVE-2020-15852 | High | 7.8 | 2020-07-20 | An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permiss… |
CVE-2020-0122 | Medium | 6.7 | 2020-07-17 | In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. T… |
CVE-2020-6165 | Medium | 5.3 | 2020-07-15 | SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The autom… |
CVE-2020-11955 | High | 8.8 | 2020-07-14 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions. |
CVE-2020-12415 | Medium | 6.5 | 2020-07-09 | When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This co… |
CVE-2020-12424 | Medium | 6.5 | 2020-07-09 | When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin… |
CVE-2020-5974 | High | 7.8 | 2020-07-08 | NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories… |
CVE-2020-15578 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-202… |
CVE-2020-5906 | High | 8.1 | 2020-07-01 | In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files… |
CVE-2020-8022 | High | 7.7 | 2020-06-29 | A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Ente… |
CVE-2020-8024 | Medium | 5.3 | 2020-06-29 | A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers t… |
CVE-2020-15351 | High | 7.8 | 2020-06-26 | IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user modify permission (i… |
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-8933 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8907 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8903 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-3626 | High | 7.8 | 2020-06-22 | Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2017-18915 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. |
CVE-2019-20889 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation. |
CVE-2019-20882 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. |
CVE-2020-14019 | High | 7.8 | 2020-06-19 | Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus per… |
CVE-2020-10782 | Medium | 6.5 | 2020-06-18 | An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and expose… |
CVE-2019-9943 | High | 7.5 | 2020-06-17 | In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may… |
CVE-2020-14156 | High | 8.8 | 2020-06-15 | user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions. |
CVE-2020-0215 | High | 7.8 | 2020-06-11 | In onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due to a permissions bypass. This could lead to local escalation… |
CVE-2020-0209 | High | 7.8 | 2020-06-11 | In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execu… |
CVE-2020-0208 | High | 7.8 | 2020-06-11 | In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execu… |
CVE-2020-0133 | High | 7.3 | 2020-06-11 | In MockLocationAppPreferenceController.java, it is possible to mock the GPS location of the device due to a permissions bypass. This could lead to local escala… |
CVE-2020-9817 | High | 7.8 | 2020-06-09 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious applicati… |
CVE-2020-13885 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application. |
CVE-2020-13884 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the… |
CVE-2020-8954 | Medium | 5.4 | 2020-06-08 | OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be manipulated] |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-13894 | High | 7.5 | 2020-06-07 | handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field. |
CVE-2020-13867 | Medium | 5.5 | 2020-06-05 | Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). |
CVE-2020-6504 | Medium | 4.3 | 2020-06-03 | Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a cr… |
CVE-2020-6502 | Medium | 6.5 | 2020-06-03 | Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6501 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML pa… |
CVE-2020-6498 | Medium | 6.5 | 2020-06-03 | Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTM… |
CVE-2020-6497 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI. |
CVE-2020-6495 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-2197 | Medium | 4.3 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurat… |
CVE-2020-2191 | Medium | 4.3 | 2020-06-03 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels. |
CVE-2017-18868 | High | 7.7 | 2020-05-21 | Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the Zig… |
CVE-2020-6488 | Medium | 4.3 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6487 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6484 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted r… |
CVE-2020-6483 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2020-6482 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6480 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions. |
CVE-2020-6476 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2020-6471 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6469 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-13240 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions… |
CVE-2020-11716 | Critical | 9.8 | 2020-05-20 | Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: the vendor states that all affected produc… |
CVE-2020-9409 | Critical | 9.8 | 2020-05-20 | The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Se… |