CWE-276 · Incorrect Default Permissions (page 16)
Page 16 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0847 | Critical | 9.8 | 2017-11-16 | An elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product: Android. Versions: 8.0. Android ID: A-65540999. |
CVE-2017-16522 | High | 8.8 | 2017-11-03 | MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh a… |
CVE-2017-1000089 | Medium | 5.3 | 2017-10-05 | Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeli… |
CVE-2017-1000084 | Medium | 6.5 | 2017-10-05 | Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as an… |
CVE-2017-12230 | High | 8.8 | 2017-09-29 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an a… |
CVE-2017-14427 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_r… |
CVE-2017-14425 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permiss… |
CVE-2017-14424 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions. |
CVE-2017-12699 | High | 7.1 | 2017-09-09 | An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or… |
CVE-2017-12763 | High | 8.8 | 2017-08-29 | An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files. |
CVE-2017-11610 | High | 8.8 | 2017-08-23 | The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbi… |
CVE-2017-11156 | High | 7.8 | 2017-08-14 | Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authe… |
CVE-2017-8625 | High | 8.8 | 2017-08-08 | Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) polic… |
CVE-2017-11741 | High | 8.8 | 2017-08-08 | HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execu… |
CVE-2017-1382 | High | 7.1 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom star… |
CVE-2017-9505 | Medium | 4.3 | 2017-06-15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comm… |
CVE-2017-4975 | High | 7.5 | 2017-06-13 | An issue was discovered in Pivotal PCF Tile Generator versions prior to 6.0.0. Tiles created by the PCF Tile Generator create a running open security group tha… |
CVE-2017-7968 | High | 7.8 | 2017-05-19 | An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation… |
CVE-2017-5686 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system… |
CVE-2017-5685 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system… |
CVE-2017-5684 | Low | 3.9 | 2017-04-03 | The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system… |
CVE-2017-5642 | Critical | 9.8 | 2017-04-03 | During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. |
CVE-2017-5622 | Medium | 5.9 | 2017-03-26 | With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious… |
CVE-2017-6404 | Medium | 5.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofin… |
CVE-2016-5425 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/li… |
CVE-2016-3943 | High | 7.8 | 2016-04-18 | Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent… |
CVE-2015-7378 | High | 7.8 | 2016-04-18 | Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to g… |
CVE-2015-7985 | | 2015-11-24 | Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse ste… | |
CVE-2013-4394 | | 2013-10-28 | The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts… | |
CVE-2013-0266 | Medium | 5.5 | 2013-03-08 | A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable… |
CVE-2013-0632 | Critical | 9.8 | 2013-01-17 | administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging… |
CVE-2012-4453 | | 2012-10-09 | dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permiss… | |
CVE-2011-4361 | | 2012-01-08 | MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information… | |
CVE-2011-2859 | | 2011-09-19 | Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors. | |
CVE-2011-2782 | | 2011-08-03 | The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remo… | |
CVE-2011-1435 | | 2011-05-03 | Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafte… | |
CVE-2010-4176 | | 2010-12-07 | plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authent… | |
CVE-2006-5014 | High | 8.8 | 2006-09-27 | Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2… |
CVE-2005-1941 | High | 7.8 | 2005-06-08 | SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and write world permissions, which allows local… |
CVE-2004-1778 | | 2004-12-22 | Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows l… | |
CVE-2002-1844 | High | 7.8 | 2002-12-31 | Microsoft Windows Media Player (WMP) 6.3, when installed on Solaris, installs executables with world-writable permissions, which allows local users to delete o… |
CVE-2002-1713 | Medium | 5.5 | 2002-12-31 | The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow… |
CVE-2001-0497 | High | 7.8 | 2001-07-21 | dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS T… |
CVE-1999-0426 | Critical | 9.8 | 1999-03-01 | The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing. |