CWE-276 · Incorrect Default Permissions (page 3)
Page 3 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54085 | Low | 3.8 | 2025-07-31 | CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the conso… |
CVE-2025-49084 | Critical | 9.1 | 2025-07-31 | CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrit… |
CVE-2025-49082 | Low | 2.7 | 2025-07-31 | CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the conso… |
CVE-2025-54530 | High | 7.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions |
CVE-2025-45467 | High | 7.1 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verificati… |
CVE-2025-8069 | High | 7.8 | 2025-07-23 | During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directo… |
CVE-2025-8031 | Critical | 9.8 | 2025-07-22 | The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability… |
CVE-2025-54059 | Medium | 4.4 | 2025-07-18 | melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange… |
CVE-2025-53945 | High | 7.0 | 2025-07-18 | apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files wer… |
CVE-2025-0886 | High | 7.8 | 2025-07-17 | An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges. |
CVE-2024-13972 | High | 8.8 | 2025-07-17 | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SY… |
CVE-2025-7672 | Medium | 4.3 | 2025-07-15 | The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: fro… |
CVE-2025-5199 | High | 7.3 | 2025-07-12 | In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying fi… |
CVE-2025-41665 | Medium | 6.5 | 2025-07-08 | An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file. |
CVE-2025-46014 | High | 8.8 | 2025-06-30 | Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or… |
CVE-2025-52991 | Low | 3.2 | 2025-06-27 | The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard user… |
CVE-2014-7210 | Critical | 9.8 | 2025-06-26 | pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backen… |
CVE-2025-52900 | Medium | 5.5 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file acc… |
CVE-2025-39201 | Medium | 6.1 | 2025-06-24 | A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of… |
CVE-2025-49144 | High | 7.3 | 2025-06-23 | Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 instal… |
CVE-2025-5963 | | 2025-06-20 | The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.securi… | |
CVE-2025-5255 | | 2025-06-20 | The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.s… | |
CVE-2025-6264 | Medium | 5.5 | 2025-06-20 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated… |
CVE-2025-49843 | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… | |
CVE-2025-49842 | | 2025-06-17 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker co… | |
CVE-2025-6179 | Critical | 9.8 | 2025-06-16 | Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and ac… |
CVE-2025-36632 | High | 7.8 | 2025-06-16 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
CVE-2025-1699 | Low | 2.8 | 2025-06-11 | An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access. |
CVE-2025-40585 | Critical | 9.9 | 2025-06-10 | A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow… |
CVE-2025-49006 | | 2025-06-09 | Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability… | |
CVE-2025-48959 | Medium | 6.7 | 2025-06-04 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 4007… |
CVE-2025-20984 | Medium | 6.8 | 2025-06-04 | Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galax… |
CVE-2025-48950 | High | 8.8 | 2025-06-03 | MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common di… |
CVE-2025-46355 | High | 7.3 | 2025-06-03 | Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Windows system where… |
CVE-2025-23105 | High | 7.8 | 2025-06-02 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. |
CVE-2025-2502 | High | 7.8 | 2025-05-30 | An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-31261 | Medium | 5.5 | 2025-05-29 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A… |
CVE-2025-4081 | | 2025-05-29 | Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib w… | |
CVE-2025-32803 | Medium | 4.0 | 2025-05-28 | In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through… |
CVE-2025-4412 | | 2025-05-27 | On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library w… | |
CVE-2025-46803 | Medium | 5.0 | 2025-05-26 | The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the syste… |
CVE-2024-13948 | High | 7.3 | 2025-05-22 | Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise… |
CVE-2025-43596 | High | 7.8 | 2025-05-22 | An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a sp… |
CVE-2025-4280 | | 2025-05-22 | MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main app… | |
CVE-2025-48070 | Low | 3.5 | 2025-05-21 | Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that ar… |
CVE-2024-45067 | High | 8.2 | 2025-05-14 | Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalatio… |
CVE-2025-20095 | Medium | 6.7 | 2025-05-13 | Incorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enable escalation… |
CVE-2024-47550 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-28954 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2025-4660 | Critical | 9.8 | 2025-05-13 | A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is acc… |
CVE-2023-31359 | High | 7.3 | 2025-05-13 | Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2023-31358 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2024-36339 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary c… |
CVE-2024-21960 | High | 7.3 | 2025-05-13 | Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege escalation potenti… |
CVE-2025-3528 | High | 8.2 | 2025-05-09 | A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. Thi… |
CVE-2025-46587 | Medium | 6.2 | 2025-05-06 | Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-46586 | Medium | 5.1 | 2025-05-06 | Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-43595 | High | 7.8 | 2025-05-01 | An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Onli… |
CVE-2025-42598 | High | 7.8 | 2025-04-28 | Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than… |
CVE-2025-32981 | High | 7.1 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File. |
CVE-2025-24914 | High | 7.8 | 2025-04-18 | When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. Thi… |
CVE-2025-30706 | High | 7.5 | 2025-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exp… |
CVE-2025-30701 | High | 7.3 | 2025-04-15 | Vulnerability in the RAS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easily… |
CVE-2025-3617 | High | 7.8 | 2025-04-15 | A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder caus… |
CVE-2025-23386 | High | 7.8 | 2025-04-10 | A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affect… |
CVE-2025-29801 | High | 7.8 | 2025-04-08 | Incorrect default permissions in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-29570 | High | 7.8 | 2025-04-03 | An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binar… |
CVE-2025-29504 | High | 7.8 | 2025-04-03 | Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification. |
CVE-2025-0014 | High | 7.3 | 2025-04-02 | Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentially resulting in arb… |
CVE-2025-30465 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sequoia 15.7.2, macOS Sonoma 14.7.5… |
CVE-2025-24277 | High | 7.8 | 2025-03-31 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-24267 | High | 7.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-24238 | Critical | 9.8 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7… |
CVE-2025-24234 | High | 7.8 | 2025-03-31 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app… |
CVE-2025-24207 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-24195 | Critical | 9.8 | 2025-03-31 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user… |
CVE-2025-24172 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. "… |
CVE-2025-24170 | High | 7.8 | 2025-03-31 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be ab… |
CVE-2025-2782 | | 2025-03-28 | The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow… | |
CVE-2025-2781 | | 2025-03-28 | The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could al… | |
CVE-2025-25535 | Critical | 9.8 | 2025-03-26 | HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request. |
CVE-2024-53351 | Critical | 9.8 | 2025-03-21 | Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2025-27612 | Medium | 5.9 | 2025-03-21 | libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilit… |
CVE-2025-24915 | High | 7.8 | 2025-03-21 | When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-dire… |
CVE-2024-54564 | Medium | 6.5 | 2025-03-21 | This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, visionOS 1.3. A file received f… |
CVE-2024-0245 | Medium | 5.5 | 2025-03-20 | A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious application… |
CVE-2025-27926 | Medium | 4.3 | 2025-03-10 | In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by u… |
CVE-2025-20910 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch Gallery. |
CVE-2025-24864 | High | 7.8 | 2025-03-06 | Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited… |
CVE-2025-22447 | High | 7.8 | 2025-03-06 | Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited… |
CVE-2025-27682 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005. |
CVE-2025-27677 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-202… |
CVE-2025-27521 | Medium | 6.8 | 2025-03-04 | Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-58050 | Medium | 6.2 | 2025-03-04 | Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58049 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58047 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58046 | Medium | 6.2 | 2025-03-04 | Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58044 | High | 8.4 | 2025-03-04 | Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-27154 | Critical | 9.8 | 2025-02-27 | Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1… |
CVE-2024-56525 | Critical | 9.8 | 2025-02-24 | In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as… |