CWE-276 · Incorrect Default Permissions (page 15)
Page 15 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14603 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user… |
CVE-2019-14568 | High | 7.8 | 2019-12-16 | Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2019-0134 | High | 7.8 | 2019-12-16 | Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to potentially execute c… |
CVE-2019-14861 | Medium | 5.3 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides admi… |
CVE-2019-19460 | Medium | 5.5 | 2019-12-03 | An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is a… |
CVE-2019-19118 | Medium | 6.5 | 2019-12-02 | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-o… |
CVE-2019-19490 | High | 7.3 | 2019-12-02 | LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe. |
CVE-2018-20090 | High | 8.3 | 2019-11-26 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-w… |
CVE-2018-17860 | High | 7.2 | 2019-11-26 | Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. |
CVE-2018-2025 | Medium | 4.4 | 2019-11-25 | IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory tha… |
CVE-2019-13662 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2012-5578 | Medium | 6.2 | 2019-11-25 | Python keyring has insecure permissions on new databases allowing world-readable files to be created |
CVE-2019-19202 | High | 8.8 | 2019-11-21 | In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2… |
CVE-2019-17421 | High | 7.8 | 2019-11-21 | Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to e… |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2019-14602 | High | 7.8 | 2019-11-14 | Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalatio… |
CVE-2012-1157 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default |
CVE-2010-5108 | High | 7.5 | 2019-11-13 | Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of… |
CVE-2019-4652 | High | 7.1 | 2019-11-12 | IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to o… |
CVE-2013-1425 | Medium | 5.5 | 2019-11-07 | ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions. |
CVE-2019-1982 | Medium | 5.3 | 2019-11-05 | A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepo… |
CVE-2019-12752 | Medium | 6.1 | 2019-11-01 | The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circ… |
CVE-2019-18369 | Medium | 5.3 | 2019-10-31 | In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. |
CVE-2019-18367 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions. |
CVE-2019-18366 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission. |
CVE-2012-5577 | High | 7.5 | 2019-10-28 | Python keyring lib before 0.10 created keyring files with world-readable permissions. |
CVE-2019-14925 | Medium | 6.5 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init… |
CVE-2019-10474 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on… |
CVE-2019-10473 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of crede… |
CVE-2019-10472 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using… |
CVE-2019-10470 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2019-10469 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-10465 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attack… |
CVE-2019-10463 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2019-16919 | High | 7.5 | 2019-10-18 | Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unau… |
CVE-2019-15962 | Medium | 4.4 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root… |
CVE-2019-14737 | High | 7.8 | 2019-10-14 | Ubisoft Uplay 92.0.0.6280 has Insecure Permissions. |
CVE-2019-17044 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges… |
CVE-2019-17043 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her… |
CVE-2019-2173 | High | 7.8 | 2019-10-11 | In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. This could lead to local e… |
CVE-2019-2114 | High | 7.8 | 2019-10-11 | In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a default permission. This c… |
CVE-2019-14510 | Medium | 6.7 | 2019-10-11 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxx… |
CVE-2015-9477 | High | 8.8 | 2019-10-10 | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9476 | High | 8.8 | 2019-10-10 | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9475 | High | 8.8 | 2019-10-10 | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9474 | High | 8.8 | 2019-10-10 | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. |
CVE-2019-17365 | High | 7.8 | 2019-10-09 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. |
CVE-2019-17383 | Critical | 9.8 | 2019-10-09 | The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. |
CVE-2019-17124 | Critical | 9.8 | 2019-10-09 | Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. |
CVE-2019-16913 | High | 7.8 | 2019-10-07 | PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyo… |
CVE-2019-3688 | Medium | 5.1 | 2019-10-07 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 1… |
CVE-2019-17056 | Low | 3.3 | 2019-10-01 | llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2019-17054 | Low | 3.3 | 2019-10-01 | atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivi… |
CVE-2019-17053 | Low | 3.3 | 2019-10-01 | ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means th… |
CVE-2019-17052 | Low | 3.3 | 2019-10-01 | ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2018-19592 | High | 7.8 | 2019-09-27 | The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the… |
CVE-2019-12670 | Medium | 6.7 | 2019-09-25 | A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace cont… |
CVE-2019-3689 | Medium | 5.1 | 2019-09-19 | The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including… |
CVE-2019-9679 | High | 8.8 | 2019-09-18 | Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include… |
CVE-2019-16355 | Medium | 5.5 | 2019-09-16 | The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. |
CVE-2019-16106 | High | 7.5 | 2019-09-10 | The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment… |
CVE-2019-16186 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions. |
CVE-2019-16185 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions. |
CVE-2019-16183 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. |
CVE-2019-15716 | Medium | 5.5 | 2019-08-28 | WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions w… |
CVE-2019-5687 | High | 7.1 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorre… |
CVE-2019-9630 | High | 7.5 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. |
CVE-2019-7588 | Medium | 6.7 | 2019-06-18 | A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. T… |
CVE-2019-12795 | High | 7.8 | 2019-06-11 | daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configu… |
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2018-7822 | Medium | 5.5 | 2019-05-22 | An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwa… |
CVE-2019-3870 | Medium | 6.1 | 2019-04-09 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are create… |
CVE-2019-0683 | Medium | 5.9 | 2019-04-09 | An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request… |
CVE-2018-13287 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain s… |
CVE-2018-13286 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obta… |
CVE-2018-11906 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged… |
CVE-2018-9085 | Medium | 4.9 | 2018-11-16 | A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administ… |
CVE-2018-12441 | High | 7.8 | 2018-10-11 | The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary… |
CVE-2018-10605 | High | 8.8 | 2018-10-01 | Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over… |
CVE-2018-14650 | Medium | 5.9 | 2018-09-27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any… |
CVE-2018-8848 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to… |
CVE-2018-12175 | High | 7.8 | 2018-09-12 | Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged user to escalate privileges via local acces… |
CVE-2018-12160 | Medium | 5.3 | 2018-09-12 | DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentiall… |
CVE-2018-11454 | High | 8.6 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-11453 | High | 7.8 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2017-3210 | High | 7.8 | 2018-07-24 | Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A n… |
CVE-2017-3209 | High | 8.1 | 2018-07-24 | The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPowe… |
CVE-2018-14335 | Medium | 6.5 | 2018-07-24 | An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permi… |
CVE-2018-10604 | High | 8.8 | 2018-07-24 | SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within th… |
CVE-2018-6683 | High | 7.4 | 2018-07-23 | Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and… |
CVE-2018-7535 | High | 7.8 | 2018-07-13 | An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files because of weak permissions (Everyone:F) u… |
CVE-2017-7794 | High | 7.8 | 2018-06-11 | On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read a… |
CVE-2017-7761 | Medium | 5.5 | 2018-06-11 | The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of… |
CVE-2017-16128 | Critical | 9.8 | 2018-06-07 | The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
CVE-2017-16127 | Critical | 9.8 | 2018-06-07 | The module pandora-doomsday infects other modules. It's since been unpublished from the registry. |
CVE-2017-0369 | Medium | 6.5 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2018-0023 | Medium | 5.5 | 2018-04-11 | JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample fil… |
CVE-2018-7533 | High | 7.8 | 2018-03-14 | An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation o… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2016-6914 | High | 7.8 | 2017-12-27 | Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Tr… |