CWE-276 · Incorrect Default Permissions (page 14)
Page 14 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13149 | High | 7.8 | 2020-05-18 | Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows loca… |
CVE-2020-12834 | Critical | 9.8 | 2020-05-15 | eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthe… |
CVE-2020-0024 | High | 7.8 | 2020-05-14 | In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could lead to local escalatio… |
CVE-2020-4259 | Medium | 6.5 | 2020-05-14 | IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cook… |
CVE-2019-9682 | High | 8.1 | 2020-05-13 | Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devi… |
CVE-2020-5896 | High | 7.8 | 2020-05-12 | On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. |
CVE-2020-12608 | High | 7.8 | 2020-05-07 | An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file p… |
CVE-2020-2183 | Medium | 6.5 | 2020-05-06 | Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to… |
CVE-2020-8018 | High | 8.4 | 2020-05-04 | A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 all… |
CVE-2020-12101 | Medium | 4.3 | 2020-04-30 | The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id fi… |
CVE-2020-12277 | Medium | 5.3 | 2020-04-29 | GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated. |
CVE-2020-8471 | High | 7.8 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2019-15793 | Medium | 6.5 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group i… |
CVE-2020-12118 | High | 8.2 | 2020-04-23 | The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing r… |
CVE-2020-8798 | Medium | 5.5 | 2020-04-23 | httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint fr… |
CVE-2020-12075 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. |
CVE-2020-11692 | Low | 2.7 | 2020-04-22 | In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators. |
CVE-2020-11689 | Medium | 6.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file. |
CVE-2020-0547 | High | 7.8 | 2020-04-15 | Incorrect default permissions in the installer for Intel(R) Data Migration Software versions 3.3 and earlier may allow an authenticated user to potentially ena… |
CVE-2020-4274 | Medium | 5.4 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to access data and perform unauthorized actions due to inadequate permission checks. IBM X-… |
CVE-2020-4270 | High | 7.8 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a local user to gain escalated privileges due to weak file permissions. IBM X-ForceID: 175846. |
CVE-2019-14326 | High | 7.8 | 2020-04-14 | An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated An… |
CVE-2020-7802 | Medium | 5.3 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-276) vulnerability. T… |
CVE-2020-6456 | Medium | 6.5 | 2020-04-13 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted cl… |
CVE-2020-6446 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6445 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |
CVE-2020-6441 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6439 | High | 8.8 | 2020-04-13 | Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page. |
CVE-2020-6431 | Medium | 4.3 | 2020-04-13 | Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-1985 | High | 7.8 | 2020-04-08 | Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privil… |
CVE-2018-21061 | Medium | 6.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger can execute critical functions in the locked state. The Samsu… |
CVE-2017-18669 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an unprotected API that allows launch of any activity with system privilege… |
CVE-2017-18668 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. Attackers can prevent users from making outbound calls and sending outbound text messag… |
CVE-2020-7004 | High | 8.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in elevation of privile… |
CVE-2020-11444 | High | 8.8 | 2020-04-02 | Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. |
CVE-2019-3944 | High | 7.5 | 2020-04-01 | Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-fligh… |
CVE-2020-5551 | High | 8.8 | 2020-03-30 | Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute… |
CVE-2020-10939 | High | 7.8 | 2020-03-27 | Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation. |
CVE-2020-3766 | High | 7.8 | 2020-03-25 | Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privile… |
CVE-2019-20536 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) (released in China) software. The Firewall application mishandles the Permiss… |
CVE-2020-9392 | High | 7.3 | 2020-03-23 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, creat… |
CVE-2020-10660 | Medium | 5.3 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Gro… |
CVE-2020-10792 | High | 7.5 | 2020-03-20 | openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "stagi… |
CVE-2019-16061 | High | 8.8 | 2020-03-19 | A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged… |
CVE-2014-2723 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2722 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2721 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2020-0514 | High | 7.8 | 2020-03-12 | Improper default permissions in the installer for Intel(R) Graphics Drivers before versions 26.20.100.7463 and 15.45.30.5103 may allow an authenticated user to… |
CVE-2020-0508 | High | 7.8 | 2020-03-12 | Incorrect default permissions in the installer for Intel(R) Graphics Drivers before versions 15.33.49.5100, 15.36.38.5117, 15.40.44.5107, 15.45.30.5103, and 26… |
CVE-2020-9543 | High | 8.3 | 2020-03-12 | OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of… |
CVE-2020-7943 | High | 7.5 | 2020-03-11 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like host… |
CVE-2020-9408 | High | 8.8 | 2020-03-11 | The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerabilit… |
CVE-2020-5342 | High | 7.8 | 2020-03-09 | Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability. A locally authenticated low-privileged malicious user… |
CVE-2019-19792 | Medium | 6.7 | 2020-03-03 | A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files. |
CVE-2020-3838 | High | 7.8 | 2020-02-27 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1… |
CVE-2020-9039 | Critical | 9.8 | 2020-02-22 | Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer… |
CVE-2020-0564 | High | 7.8 | 2020-02-13 | Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalati… |
CVE-2020-0562 | High | 7.8 | 2020-02-13 | Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2020-0560 | High | 7.8 | 2020-02-13 | Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enab… |
CVE-2019-2200 | High | 7.3 | 2020-02-13 | In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permissio… |
CVE-2020-2118 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to en… |
CVE-2020-2117 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attac… |
CVE-2019-14002 | High | 7.8 | 2020-02-07 | APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-20106 | Medium | 4.3 | 2020-02-06 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remo… |
CVE-2020-7977 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. |
CVE-2020-7972 | High | 7.5 | 2020-02-05 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). |
CVE-2020-7967 | Medium | 4.3 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). |
CVE-2020-8114 | Critical | 9.8 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2020-7979 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2020-5231 | Medium | 4.8 | 2020-01-30 | In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. RO… |
CVE-2014-7303 | High | 7.8 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspeci… |
CVE-2014-7302 | High | 7.8 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by exec… |
CVE-2014-7301 | Medium | 6.6 | 2020-01-27 | SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and possibly other unspeci… |
CVE-2019-17103 | Medium | 4.9 | 2020-01-27 | An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected… |
CVE-2019-18900 | Medium | 4.0 | 2020-01-24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed lo… |
CVE-2019-3687 | Medium | 4.0 | 2020-01-24 | The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This… |
CVE-2019-19896 | Critical | 9.9 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine Service share. The default file permissions of the IXP$ share o… |
CVE-2019-19392 | Critical | 9.8 | 2020-01-21 | The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator priv… |
CVE-2019-14601 | High | 7.8 | 2020-01-17 | Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalat… |
CVE-2020-5196 | High | 8.1 | 2020-01-14 | Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list direct… |
CVE-2019-19475 | High | 8.8 | 2020-01-10 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to a… |
CVE-2012-4434 | High | 8.8 | 2020-01-09 | fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. |
CVE-2020-6166 | Medium | 5.4 | 2020-01-09 | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change… |
CVE-2019-11765 | Medium | 6.5 | 2020-01-08 | A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to la… |
CVE-2020-0009 | Medium | 5.5 | 2020-01-08 | In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of priv… |
CVE-2019-16716 | Medium | 6.6 | 2020-01-06 | OX App Suite through 7.10.2 has Incorrect Access Control. |
CVE-2013-4859 | High | 8.1 | 2019-12-27 | INSTEON Hub 2242-222 lacks Web and API authentication |
CVE-2013-4764 | Medium | 4.3 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission. |
CVE-2013-4763 | Medium | 4.6 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission. |
CVE-2019-11097 | High | 7.8 | 2019-12-18 | Improper directory permissions in the installer for Intel(R) Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45… |
CVE-2019-19724 | High | 7.5 | 2019-12-18 | Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an informat… |
CVE-2019-8731 | Medium | 5.5 | 2019-12-18 | A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fi… |
CVE-2019-17334 | High | 8.0 | 2019-12-17 | The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment… |
CVE-2019-19675 | High | 7.8 | 2019-12-17 | In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspec… |
CVE-2019-16559 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and… |
CVE-2019-16554 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a… |
CVE-2019-16552 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2019-19712 | Medium | 5.3 | 2019-12-17 | Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for… |
CVE-2019-15011 | Medium | 4.3 | 2019-12-17 | The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3… |
CVE-2019-14605 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable esca… |