CWE-276 · Incorrect Default Permissions (page 15)
Page 15 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5196 | High | 8.1 | 2020-01-14 | Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list direct… |
CVE-2019-19475 | High | 8.8 | 2020-01-10 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to a… |
CVE-2012-4434 | High | 8.8 | 2020-01-09 | fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. |
CVE-2020-6166 | Medium | 5.4 | 2020-01-09 | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change… |
CVE-2019-11765 | Medium | 6.5 | 2020-01-08 | A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to la… |
CVE-2020-0009 | Medium | 5.5 | 2020-01-08 | In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of priv… |
CVE-2019-16716 | Medium | 6.6 | 2020-01-06 | OX App Suite through 7.10.2 has Incorrect Access Control. |
CVE-2013-4859 | High | 8.1 | 2019-12-27 | INSTEON Hub 2242-222 lacks Web and API authentication |
CVE-2013-4764 | Medium | 4.3 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission. |
CVE-2013-4763 | Medium | 4.6 | 2019-12-27 | Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission. |
CVE-2019-11097 | High | 7.8 | 2019-12-18 | Improper directory permissions in the installer for Intel(R) Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45… |
CVE-2019-19724 | High | 7.5 | 2019-12-18 | Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an informat… |
CVE-2019-8731 | Medium | 5.5 | 2019-12-18 | A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fi… |
CVE-2019-17334 | High | 8.0 | 2019-12-17 | The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment… |
CVE-2019-19675 | High | 7.8 | 2019-12-17 | In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspec… |
CVE-2019-16559 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and… |
CVE-2019-16554 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a… |
CVE-2019-16552 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2019-19712 | Medium | 5.3 | 2019-12-17 | Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for… |
CVE-2019-15011 | Medium | 4.3 | 2019-12-17 | The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3… |
CVE-2019-14605 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable esca… |
CVE-2019-14603 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user… |
CVE-2019-14568 | High | 7.8 | 2019-12-16 | Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2019-0134 | High | 7.8 | 2019-12-16 | Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to potentially execute c… |
CVE-2019-14861 | Medium | 5.3 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides admi… |
CVE-2019-19460 | Medium | 5.5 | 2019-12-03 | An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is a… |
CVE-2019-19118 | Medium | 6.5 | 2019-12-02 | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-o… |
CVE-2019-19490 | High | 7.3 | 2019-12-02 | LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe. |
CVE-2018-20090 | High | 8.3 | 2019-11-26 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-w… |
CVE-2018-17860 | High | 7.2 | 2019-11-26 | Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. |
CVE-2018-2025 | Medium | 4.4 | 2019-11-25 | IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory tha… |
CVE-2019-13662 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2012-5578 | Medium | 6.2 | 2019-11-25 | Python keyring has insecure permissions on new databases allowing world-readable files to be created |
CVE-2019-19202 | High | 8.8 | 2019-11-21 | In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2… |
CVE-2019-17421 | High | 7.8 | 2019-11-21 | Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to e… |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2019-14602 | High | 7.8 | 2019-11-14 | Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalatio… |
CVE-2012-1157 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default |
CVE-2010-5108 | High | 7.5 | 2019-11-13 | Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of… |
CVE-2019-4652 | High | 7.1 | 2019-11-12 | IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to o… |
CVE-2013-1425 | Medium | 5.5 | 2019-11-07 | ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions. |
CVE-2019-1982 | Medium | 5.3 | 2019-11-05 | A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepo… |
CVE-2019-12752 | Medium | 6.1 | 2019-11-01 | The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circ… |
CVE-2019-18369 | Medium | 5.3 | 2019-10-31 | In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. |
CVE-2019-18367 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions. |
CVE-2019-18366 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission. |
CVE-2012-5577 | High | 7.5 | 2019-10-28 | Python keyring lib before 0.10 created keyring files with world-readable permissions. |
CVE-2019-14925 | Medium | 6.5 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init… |
CVE-2019-10474 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on… |
CVE-2019-10473 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of crede… |
CVE-2019-10472 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using… |
CVE-2019-10470 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2019-10469 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-10465 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attack… |
CVE-2019-10463 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2019-16919 | High | 7.5 | 2019-10-18 | Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unau… |
CVE-2019-15962 | Medium | 4.4 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root… |
CVE-2019-14737 | High | 7.8 | 2019-10-14 | Ubisoft Uplay 92.0.0.6280 has Insecure Permissions. |
CVE-2019-17044 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges… |
CVE-2019-17043 | High | 7.8 | 2019-10-14 | An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her… |
CVE-2019-2173 | High | 7.8 | 2019-10-11 | In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. This could lead to local e… |
CVE-2019-2114 | High | 7.8 | 2019-10-11 | In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a default permission. This c… |
CVE-2019-14510 | Medium | 6.7 | 2019-10-11 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxx… |
CVE-2015-9477 | High | 8.8 | 2019-10-10 | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9476 | High | 8.8 | 2019-10-10 | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9475 | High | 8.8 | 2019-10-10 | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9474 | High | 8.8 | 2019-10-10 | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. |
CVE-2019-17365 | High | 7.8 | 2019-10-09 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. |
CVE-2019-17383 | Critical | 9.8 | 2019-10-09 | The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. |
CVE-2019-17124 | Critical | 9.8 | 2019-10-09 | Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. |
CVE-2019-16913 | High | 7.8 | 2019-10-07 | PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyo… |
CVE-2019-3688 | Medium | 5.1 | 2019-10-07 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 1… |
CVE-2019-17056 | Low | 3.3 | 2019-10-01 | llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2019-17054 | Low | 3.3 | 2019-10-01 | atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivi… |
CVE-2019-17053 | Low | 3.3 | 2019-10-01 | ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means th… |
CVE-2019-17052 | Low | 3.3 | 2019-10-01 | ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2018-19592 | High | 7.8 | 2019-09-27 | The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the… |
CVE-2019-12670 | Medium | 6.7 | 2019-09-25 | A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace cont… |
CVE-2019-3689 | Medium | 5.1 | 2019-09-19 | The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including… |
CVE-2019-9679 | High | 8.8 | 2019-09-18 | Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include… |
CVE-2019-16355 | Medium | 5.5 | 2019-09-16 | The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. |
CVE-2019-16106 | High | 7.5 | 2019-09-10 | The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment… |
CVE-2019-16186 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions. |
CVE-2019-16185 | High | 7.2 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions. |
CVE-2019-16183 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. |
CVE-2019-15716 | Medium | 5.5 | 2019-08-28 | WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions w… |
CVE-2019-5687 | High | 7.1 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorre… |
CVE-2019-9630 | High | 7.5 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. |
CVE-2019-7588 | Medium | 6.7 | 2019-06-18 | A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. T… |
CVE-2019-12795 | High | 7.8 | 2019-06-11 | daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configu… |
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2018-7822 | Medium | 5.5 | 2019-05-22 | An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwa… |
CVE-2019-3870 | Medium | 6.1 | 2019-04-09 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are create… |
CVE-2019-0683 | Medium | 5.9 | 2019-04-09 | An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request… |
CVE-2018-13287 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain s… |
CVE-2018-13286 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obta… |
CVE-2018-11906 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged… |
CVE-2018-9085 | Medium | 4.9 | 2018-11-16 | A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administ… |
CVE-2018-12441 | High | 7.8 | 2018-10-11 | The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary… |
CVE-2018-10605 | High | 8.8 | 2018-10-01 | Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over… |