CWE-276 · Incorrect Default Permissions (page 5)
Page 5 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52867 | High | 8.1 | 2024-11-17 | guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for… |
CVE-2024-51765 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cl… |
CVE-2024-51764 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to lo… |
CVE-2017-13314 | High | 7.8 | 2024-11-15 | In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to… |
CVE-2017-13312 | High | 7.8 | 2024-11-15 | In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. This could lead to local escalation of p… |
CVE-2017-13311 | Medium | 6.7 | 2024-11-15 | In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escal… |
CVE-2017-13310 | High | 7.8 | 2024-11-15 | In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation… |
CVE-2024-46467 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with h… |
CVE-2024-46466 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misu… |
CVE-2024-46465 | High | 7.8 | 2024-11-15 | By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46463 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46462 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with hig… |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-52551 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a… |
CVE-2024-35201 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via… |
CVE-2024-29083 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable esc… |
CVE-2024-25647 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentia… |
CVE-2024-21820 | High | 7.2 | 2024-11-13 | Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potent… |
CVE-2024-43089 | High | 7.8 | 2024-11-13 | In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalat… |
CVE-2024-43086 | Medium | 5.5 | 2024-11-13 | In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. T… |
CVE-2024-43085 | High | 7.8 | 2024-11-13 | In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in t… |
CVE-2024-43081 | High | 7.8 | 2024-11-13 | In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead… |
CVE-2024-40661 | High | 7.8 | 2024-11-13 | In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This co… |
CVE-2024-40660 | High | 7.8 | 2024-11-13 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead… |
CVE-2024-49504 | | 2024-11-13 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. | |
CVE-2024-21958 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resul… |
CVE-2024-21957 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resultin… |
CVE-2024-21946 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resu… |
CVE-2024-21945 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potential… |
CVE-2024-21939 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escala… |
CVE-2024-21938 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an… |
CVE-2024-21937 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitr… |
CVE-2024-46894 | Medium | 6.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a use… |
CVE-2024-47593 | Medium | 4.3 | 2024-11-12 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted… |
CVE-2024-43430 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2023-27195 | Critical | 9.8 | 2024-11-08 | Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use… |
CVE-2024-36063 | High | 7.5 | 2024-11-07 | The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place phone calls withou… |
CVE-2020-11921 | High | 8.8 | 2024-11-07 | An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection… |
CVE-2019-20458 | High | 8.8 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no… |
CVE-2019-20457 | Critical | 9.1 | 2024-11-07 | An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because t… |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-9191 | High | 7.1 | 2024-11-01 | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compr… |
CVE-2024-48572 | Medium | 5.3 | 2024-10-29 | A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The v… |
CVE-2024-44228 | High | 7.5 | 2024-10-28 | This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user d… |
CVE-2024-40792 | Low | 3.3 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A malicious app may be able to change network settings. |
CVE-2024-42028 | High | 8.8 | 2024-10-28 | A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a mal… |
CVE-2024-10469 | Medium | 6.5 | 2024-10-28 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. |
CVE-2022-30355 | Critical | 9.8 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters… |
CVE-2024-47016 | High | 7.8 | 2024-10-25 | there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-47014 | High | 8.8 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292. |
CVE-2024-47013 | High | 7.8 | 2024-10-25 | In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privil… |
CVE-2024-47012 | High | 7.8 | 2024-10-25 | In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escal… |
CVE-2024-44100 | High | 7.5 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545. |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-7587 | High | 7.8 | 2024-10-22 | Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, M… |
CVE-2024-10183 | | 2024-10-22 | A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems. | |
CVE-2024-35287 | Medium | 6.7 | 2024-10-21 | A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with adminis… |
CVE-2024-47825 | Medium | 4.0 | 2024-10-21 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10… |
CVE-2024-47240 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system… |
CVE-2024-49389 | High | 7.8 | 2024-10-17 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-9858 | High | 7.8 | 2024-10-16 | There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was grea… |
CVE-2024-48823 | Critical | 9.8 | 2024-10-14 | Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48822 | High | 8.8 | 2024-10-14 | Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-5474 | Medium | 5.5 | 2024-10-11 | A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could a… |
CVE-2024-39544 | Medium | 5.0 | 2024-10-11 | An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker… |
CVE-2023-42133 | Medium | 6.7 | 2024-10-11 | PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account priv… |
CVE-2024-9167 | High | 7.8 | 2024-10-08 | Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-46544 | Medium | 5.9 | 2024-09-23 | Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration whi… |
CVE-2022-25776 | High | 8.3 | 2024-09-18 | Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could… |
CVE-2024-44151 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be a… |
CVE-2024-44135 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protec… |
CVE-2024-39924 | High | 8.8 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of t… |
CVE-2024-46695 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko report… |
CVE-2024-8533 | High | 8.8 | 2024-09-12 | A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions all… |
CVE-2024-38222 | Medium | 6.5 | 2024-09-12 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-40655 | High | 7.8 | 2024-09-11 | In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a pe… |
CVE-2024-40654 | High | 7.8 | 2024-09-11 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-34661 | Medium | 4.3 | 2024-09-04 | Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction… |
CVE-2024-34648 | Medium | 5.1 | 2024-09-04 | Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34018 | Medium | 5.5 | 2024-08-29 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-44760 | High | 7.5 | 2024-08-28 | Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to acce… |
CVE-2023-45896 | High | 7.1 | 2024-08-28 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… |
CVE-2024-43791 | High | 7.8 | 2024-08-23 | RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are worl… |
CVE-2024-4763 | High | 7.8 | 2024-08-16 | An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a lo… |
CVE-2024-2175 | High | 7.8 | 2024-08-16 | An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow… |
CVE-2024-42681 | High | 8.8 | 2024-08-15 | Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. |
CVE-2024-27461 | Medium | 5.6 | 2024-08-14 | Incorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2024-26025 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-23974 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2024-23495 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable esca… |
CVE-2024-22378 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated u… |
CVE-2023-43747 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticated user to potent… |
CVE-2023-31349 | High | 7.3 | 2024-08-13 | Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitra… |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-34617 | Medium | 4.0 | 2024-08-07 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application. |
CVE-2024-34616 | Medium | 5.1 | 2024-08-07 | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-7525 | High | 8.1 | 2024-08-06 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on… |
CVE-2024-43114 | High | 7.5 | 2024-08-06 | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions |