CWE-276 · Incorrect Default Permissions (page 13)
Page 13 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13540 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 A… |
CVE-2020-13539 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911… |
CVE-2020-29492 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-29491 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-26031 | Medium | 4.3 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have… |
CVE-2020-13535 | High | 7.8 | 2020-12-18 | A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configurat… |
CVE-2020-0486 | High | 7.8 | 2020-12-15 | In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation… |
CVE-2020-5798 | High | 7.8 | 2020-12-07 | inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to impro… |
CVE-2020-13542 | High | 7.8 | 2020-12-03 | A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker c… |
CVE-2020-8539 | High | 7.8 | 2020-12-01 | Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, b… |
CVE-2020-11867 | Low | 3.3 | 2020-11-30 | Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to… |
CVE-2020-12510 | High | 7.3 | 2020-11-19 | The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirec… |
CVE-2020-13351 | Medium | 6.5 | 2020-11-17 | Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on… |
CVE-2020-24460 | Medium | 5.5 | 2020-11-12 | Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2020-24456 | High | 7.8 | 2020-11-12 | Incorrect default permissions in the Intel(R) Board ID Tool version v.1.01 may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2020-12346 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Battery Life Diagnostic Tool before version 1.0.7 may allow an authenticated user to potentially enable… |
CVE-2020-13770 | High | 7.8 | 2020-11-12 | Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services… |
CVE-2020-12354 | High | 7.8 | 2020-11-12 | Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escala… |
CVE-2020-12307 | High | 7.8 | 2020-11-12 | Improper permissions in some Intel(R) High Definition Audio drivers before version 9.21.00.4561 may allow an authenticated user to potentially enable escalatio… |
CVE-2020-12306 | High | 7.8 | 2020-11-12 | Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potent… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-24402 | Medium | 4.9 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could… |
CVE-2020-13537 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-13536 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-28044 | Medium | 6.8 | 2020-11-02 | An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and… |
CVE-2020-28041 | Medium | 6.5 | 2020-11-02 | The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a… |
CVE-2020-27358 | Medium | 4.3 | 2020-11-02 | An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) all… |
CVE-2019-8777 | Low | 2.4 | 2020-10-27 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave… |
CVE-2019-14718 | Medium | 6.7 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privil… |
CVE-2020-27665 | High | 7.5 | 2020-10-22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. |
CVE-2020-17381 | High | 7.3 | 2020-10-21 | An issue was discovered in Ghisler Total Commander 9.51. Due to insufficient access restrictions in the default installation directory, an attacker can elevate… |
CVE-2020-15843 | High | 7.3 | 2020-09-24 | ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveF… |
CVE-2020-15850 | High | 7.8 | 2020-09-24 | Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and ga… |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-0294 | Medium | 5.5 | 2020-09-18 | In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local… |
CVE-2020-0374 | High | 7.8 | 2020-09-17 | In NFC, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges n… |
CVE-2020-0275 | High | 7.8 | 2020-09-17 | In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permissions bypass. This c… |
CVE-2020-0390 | Medium | 5.5 | 2020-09-17 | In the app zygote SE Policy, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges ne… |
CVE-2020-0388 | High | 7.8 | 2020-09-17 | In createEmergencyLocationUserNotification of GnssVisibilityControl.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This co… |
CVE-2020-8346 | Medium | 5.5 | 2020-09-15 | A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could a… |
CVE-2020-10050 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application… |
CVE-2020-10049 | High | 7.3 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected applicat… |
CVE-2019-10679 | High | 7.8 | 2020-09-03 | Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissi… |
CVE-2020-23971 | High | 7.5 | 2020-09-01 | gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload function without authenticating to the appli… |
CVE-2020-24584 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of… |
CVE-2020-24583 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode… |
CVE-2020-7527 | High | 7.8 | 2020-08-31 | Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full access control to loca… |
CVE-2020-13468 | Medium | 6.8 | 2020-08-31 | Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding wires (which have… |
CVE-2020-24717 | High | 7.8 | 2020-08-27 | OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. |
CVE-2020-3485 | Medium | 6.3 | 2020-08-26 | A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an au… |
CVE-2020-3484 | Medium | 5.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentia… |
CVE-2020-3152 | Medium | 6.7 | 2020-08-26 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary c… |
CVE-2020-7824 | Medium | 6.5 | 2020-08-25 | A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability… |
CVE-2020-1571 | High | 7.3 | 2020-08-17 | An elevation of privilege vulnerability exists in Windows Setup in the way it handles permissions. A locally authenticated attacker could run arbitrary code wi… |
CVE-2020-15145 | Medium | 6.7 | 2020-08-14 | In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the followi… |
CVE-2020-8763 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enab… |
CVE-2020-8743 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) Mailbox Interface driver, all versions, may allow an authenticated user to potentially enable escalation… |
CVE-2020-12287 | High | 7.8 | 2020-08-13 | Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalati… |
CVE-2020-15821 | Medium | 6.5 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. |
CVE-2020-8026 | High | 8.4 | 2020-08-07 | A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers wit… |
CVE-2020-8219 | High | 7.2 | 2020-07-30 | An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator. |
CVE-2020-2077 | High | 7.5 | 2020-07-29 | SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker coul… |
CVE-2020-10606 | High | 7.8 | 2020-07-24 | In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation c… |
CVE-2020-6527 | Medium | 4.3 | 2020-07-22 | Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML pa… |
CVE-2020-15852 | High | 7.8 | 2020-07-20 | An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permiss… |
CVE-2020-0122 | Medium | 6.7 | 2020-07-17 | In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. T… |
CVE-2020-6165 | Medium | 5.3 | 2020-07-15 | SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The autom… |
CVE-2020-11955 | High | 8.8 | 2020-07-14 | An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions. |
CVE-2020-12415 | Medium | 6.5 | 2020-07-09 | When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This co… |
CVE-2020-12424 | Medium | 6.5 | 2020-07-09 | When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin… |
CVE-2020-5974 | High | 7.8 | 2020-07-08 | NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories… |
CVE-2020-15578 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-202… |
CVE-2020-5906 | High | 8.1 | 2020-07-01 | In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files… |
CVE-2020-8022 | High | 7.7 | 2020-06-29 | A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Ente… |
CVE-2020-8024 | Medium | 5.3 | 2020-06-29 | A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers t… |
CVE-2020-15351 | High | 7.8 | 2020-06-26 | IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user modify permission (i… |
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-8933 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8907 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-8903 | High | 7.8 | 2020-06-22 | A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLo… |
CVE-2020-3626 | High | 7.8 | 2020-06-22 | Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2017-18915 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. |
CVE-2019-20889 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation. |
CVE-2019-20882 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. |
CVE-2020-14019 | High | 7.8 | 2020-06-19 | Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus per… |
CVE-2020-10782 | Medium | 6.5 | 2020-06-18 | An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and expose… |
CVE-2019-9943 | High | 7.5 | 2020-06-17 | In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may… |
CVE-2020-14156 | High | 8.8 | 2020-06-15 | user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions. |
CVE-2020-0215 | High | 7.8 | 2020-06-11 | In onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due to a permissions bypass. This could lead to local escalation… |
CVE-2020-0209 | High | 7.8 | 2020-06-11 | In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execu… |
CVE-2020-0208 | High | 7.8 | 2020-06-11 | In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execu… |
CVE-2020-0133 | High | 7.3 | 2020-06-11 | In MockLocationAppPreferenceController.java, it is possible to mock the GPS location of the device due to a permissions bypass. This could lead to local escala… |
CVE-2020-9817 | High | 7.8 | 2020-06-09 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious applicati… |
CVE-2020-13885 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application. |
CVE-2020-13884 | High | 7.8 | 2020-06-08 | Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the… |
CVE-2020-8954 | Medium | 5.4 | 2020-06-08 | OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be manipulated] |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-13894 | High | 7.5 | 2020-06-07 | handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field. |
CVE-2020-13867 | Medium | 5.5 | 2020-06-05 | Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). |