CWE-276 · Incorrect Default Permissions (page 16)
Page 16 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14650 | Medium | 5.9 | 2018-09-27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any… |
CVE-2018-8848 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to… |
CVE-2018-12175 | High | 7.8 | 2018-09-12 | Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged user to escalate privileges via local acces… |
CVE-2018-12160 | Medium | 5.3 | 2018-09-12 | DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentiall… |
CVE-2018-11454 | High | 8.6 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-11453 | High | 7.8 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2017-3210 | High | 7.8 | 2018-07-24 | Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A n… |
CVE-2017-3209 | High | 8.1 | 2018-07-24 | The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPowe… |
CVE-2018-14335 | Medium | 6.5 | 2018-07-24 | An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permi… |
CVE-2018-10604 | High | 8.8 | 2018-07-24 | SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within th… |
CVE-2018-6683 | High | 7.4 | 2018-07-23 | Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and… |
CVE-2018-7535 | High | 7.8 | 2018-07-13 | An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files because of weak permissions (Everyone:F) u… |
CVE-2017-7794 | High | 7.8 | 2018-06-11 | On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read a… |
CVE-2017-7761 | Medium | 5.5 | 2018-06-11 | The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of… |
CVE-2017-16128 | Critical | 9.8 | 2018-06-07 | The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
CVE-2017-16127 | Critical | 9.8 | 2018-06-07 | The module pandora-doomsday infects other modules. It's since been unpublished from the registry. |
CVE-2017-0369 | Medium | 6.5 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2018-0023 | Medium | 5.5 | 2018-04-11 | JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample fil… |
CVE-2018-7533 | High | 7.8 | 2018-03-14 | An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation o… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2016-6914 | High | 7.8 | 2017-12-27 | Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Tr… |
CVE-2017-0847 | Critical | 9.8 | 2017-11-16 | An elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product: Android. Versions: 8.0. Android ID: A-65540999. |
CVE-2017-16522 | High | 8.8 | 2017-11-03 | MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh a… |
CVE-2017-1000089 | Medium | 5.3 | 2017-10-05 | Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeli… |
CVE-2017-1000084 | Medium | 6.5 | 2017-10-05 | Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as an… |
CVE-2017-12230 | High | 8.8 | 2017-09-29 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an a… |
CVE-2017-14427 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_r… |
CVE-2017-14425 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permiss… |
CVE-2017-14424 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions. |
CVE-2017-12699 | High | 7.1 | 2017-09-09 | An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or… |
CVE-2017-12763 | High | 8.8 | 2017-08-29 | An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files. |
CVE-2017-11610 | High | 8.8 | 2017-08-23 | The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbi… |
CVE-2017-11156 | High | 7.8 | 2017-08-14 | Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authe… |
CVE-2017-8625 | High | 8.8 | 2017-08-08 | Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) polic… |
CVE-2017-11741 | High | 8.8 | 2017-08-08 | HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execu… |
CVE-2017-1382 | High | 7.1 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom star… |
CVE-2017-9505 | Medium | 4.3 | 2017-06-15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comm… |
CVE-2017-4975 | High | 7.5 | 2017-06-13 | An issue was discovered in Pivotal PCF Tile Generator versions prior to 6.0.0. Tiles created by the PCF Tile Generator create a running open security group tha… |
CVE-2017-7968 | High | 7.8 | 2017-05-19 | An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation… |
CVE-2017-5686 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system… |
CVE-2017-5685 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system… |
CVE-2017-5684 | Low | 3.9 | 2017-04-03 | The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system… |
CVE-2017-5642 | Critical | 9.8 | 2017-04-03 | During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. |
CVE-2017-5622 | Medium | 5.9 | 2017-03-26 | With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious… |
CVE-2017-6404 | Medium | 5.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofin… |
CVE-2016-5425 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/li… |
CVE-2016-3943 | High | 7.8 | 2016-04-18 | Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent… |
CVE-2015-7378 | High | 7.8 | 2016-04-18 | Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to g… |
CVE-2015-7985 | | 2015-11-24 | Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse ste… | |
CVE-2013-4394 | | 2013-10-28 | The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts… | |
CVE-2013-0266 | Medium | 5.5 | 2013-03-08 | A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable… |
CVE-2013-0632 | Critical | 9.8 | 2013-01-17 | administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging… |
CVE-2012-4453 | | 2012-10-09 | dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permiss… | |
CVE-2011-4361 | | 2012-01-08 | MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information… | |
CVE-2011-2859 | | 2011-09-19 | Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors. | |
CVE-2011-2782 | | 2011-08-03 | The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remo… | |
CVE-2011-1435 | | 2011-05-03 | Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafte… | |
CVE-2010-4176 | | 2010-12-07 | plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authent… | |
CVE-2006-5014 | High | 8.8 | 2006-09-27 | Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2… |
CVE-2005-1941 | High | 7.8 | 2005-06-08 | SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and write world permissions, which allows local… |
CVE-2004-1778 | | 2004-12-22 | Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows l… | |
CVE-2002-1844 | High | 7.8 | 2002-12-31 | Microsoft Windows Media Player (WMP) 6.3, when installed on Solaris, installs executables with world-writable permissions, which allows local users to delete o… |
CVE-2002-1713 | Medium | 5.5 | 2002-12-31 | The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow… |
CVE-2001-0497 | High | 7.8 | 2001-07-21 | dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS T… |
CVE-1999-0426 | Critical | 9.8 | 1999-03-01 | The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing. |