CWE-276 · Incorrect Default Permissions (page 5)
Page 5 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9431 | High | 7.8 | 2024-12-02 | In OSUInfo of OSUInfo.java, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2024-11969 | High | 8.8 | 2024-11-28 | The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exp… |
CVE-2024-46054 | Critical | 9.8 | 2024-11-27 | OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. |
CVE-2024-6476 | Medium | 4.2 | 2024-11-26 | Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirectin… |
CVE-2024-27134 | High | 7.0 | 2024-11-25 | Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain… |
CVE-2024-50657 | Medium | 6.8 | 2024-11-22 | An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the che… |
CVE-2024-44786 | High | 7.5 | 2024-11-22 | Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors. |
CVE-2024-11089 | Medium | 5.3 | 2024-11-21 | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordP… |
CVE-2024-11088 | Medium | 5.3 | 2024-11-21 | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core s… |
CVE-2024-48533 | Medium | 5.3 | 2024-11-20 | A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enum… |
CVE-2024-51162 | High | 8.8 | 2024-11-20 | An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, it was identified tha… |
CVE-2024-45690 | High | 7.5 | 2024-11-20 | A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. |
CVE-2018-9467 | Critical | 9.8 | 2024-11-20 | In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with… |
CVE-2018-9432 | High | 7.8 | 2024-11-19 | In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local esca… |
CVE-2018-9369 | High | 7.3 | 2024-11-19 | In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additio… |
CVE-2023-21270 | High | 7.8 | 2024-11-19 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect… |
CVE-2024-51051 | Critical | 9.8 | 2024-11-18 | AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account. |
CVE-2024-48293 | Medium | 6.5 | 2024-11-18 | Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbitrarily modify antiv… |
CVE-2024-48292 | High | 8.8 | 2024-11-18 | An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate priv… |
CVE-2024-28058 | High | 7.5 | 2024-11-18 | In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat acto… |
CVE-2024-52946 | High | 8.8 | 2024-11-18 | An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication lev… |
CVE-2024-52926 | Medium | 6.5 | 2024-11-18 | Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. |
CVE-2024-52867 | High | 8.1 | 2024-11-17 | guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for… |
CVE-2024-51765 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cl… |
CVE-2024-51764 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to lo… |
CVE-2017-13314 | High | 7.8 | 2024-11-15 | In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to… |
CVE-2017-13312 | High | 7.8 | 2024-11-15 | In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. This could lead to local escalation of p… |
CVE-2017-13311 | Medium | 6.7 | 2024-11-15 | In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escal… |
CVE-2017-13310 | High | 7.8 | 2024-11-15 | In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation… |
CVE-2024-46467 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with h… |
CVE-2024-46466 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misu… |
CVE-2024-46465 | High | 7.8 | 2024-11-15 | By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46463 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46462 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with hig… |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-52551 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a… |
CVE-2024-35201 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via… |
CVE-2024-29083 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable esc… |
CVE-2024-25647 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentia… |
CVE-2024-21820 | High | 7.2 | 2024-11-13 | Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potent… |
CVE-2024-43089 | High | 7.8 | 2024-11-13 | In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalat… |
CVE-2024-43086 | Medium | 5.5 | 2024-11-13 | In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. T… |
CVE-2024-43085 | High | 7.8 | 2024-11-13 | In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in t… |
CVE-2024-43081 | High | 7.8 | 2024-11-13 | In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead… |
CVE-2024-40661 | High | 7.8 | 2024-11-13 | In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This co… |
CVE-2024-40660 | High | 7.8 | 2024-11-13 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead… |
CVE-2024-49504 | | 2024-11-13 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. | |
CVE-2024-21958 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resul… |
CVE-2024-21957 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resultin… |
CVE-2024-21946 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resu… |
CVE-2024-21945 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potential… |
CVE-2024-21939 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escala… |
CVE-2024-21938 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an… |
CVE-2024-21937 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitr… |
CVE-2024-46894 | Medium | 6.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a use… |
CVE-2024-47593 | Medium | 4.3 | 2024-11-12 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted… |
CVE-2024-43430 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2023-27195 | Critical | 9.8 | 2024-11-08 | Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use… |
CVE-2024-36063 | High | 7.5 | 2024-11-07 | The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place phone calls withou… |
CVE-2020-11921 | High | 8.8 | 2024-11-07 | An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection… |
CVE-2019-20458 | High | 8.8 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no… |
CVE-2019-20457 | Critical | 9.1 | 2024-11-07 | An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because t… |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-9191 | High | 7.1 | 2024-11-01 | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compr… |
CVE-2024-48572 | Medium | 5.3 | 2024-10-29 | A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The v… |
CVE-2024-44228 | High | 7.5 | 2024-10-28 | This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user d… |
CVE-2024-40792 | Low | 3.3 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A malicious app may be able to change network settings. |
CVE-2024-42028 | High | 8.8 | 2024-10-28 | A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a mal… |
CVE-2024-10469 | Medium | 6.5 | 2024-10-28 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. |
CVE-2022-30355 | Critical | 9.8 | 2024-10-25 | OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters… |
CVE-2024-47016 | High | 7.8 | 2024-10-25 | there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-47014 | High | 8.8 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292. |
CVE-2024-47013 | High | 7.8 | 2024-10-25 | In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privil… |
CVE-2024-47012 | High | 7.8 | 2024-10-25 | In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escal… |
CVE-2024-44100 | High | 7.5 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545. |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-7587 | High | 7.8 | 2024-10-22 | Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, M… |
CVE-2024-10183 | | 2024-10-22 | A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems. | |
CVE-2024-35287 | Medium | 6.7 | 2024-10-21 | A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with adminis… |
CVE-2024-47825 | Medium | 4.0 | 2024-10-21 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10… |
CVE-2024-47240 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system… |
CVE-2024-49389 | High | 7.8 | 2024-10-17 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-9858 | High | 7.8 | 2024-10-16 | There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was grea… |
CVE-2024-48823 | Critical | 9.8 | 2024-10-14 | Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48822 | High | 8.8 | 2024-10-14 | Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-5474 | Medium | 5.5 | 2024-10-11 | A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could a… |
CVE-2024-39544 | Medium | 5.0 | 2024-10-11 | An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker… |
CVE-2023-42133 | Medium | 6.7 | 2024-10-11 | PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account priv… |
CVE-2024-9167 | High | 7.8 | 2024-10-08 | Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-46544 | Medium | 5.9 | 2024-09-23 | Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration whi… |
CVE-2022-25776 | High | 8.3 | 2024-09-18 | Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could… |
CVE-2024-44151 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be a… |
CVE-2024-44135 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protec… |
CVE-2024-39924 | High | 8.8 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of t… |
CVE-2024-46695 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko report… |
CVE-2024-8533 | High | 8.8 | 2024-09-12 | A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions all… |
CVE-2024-38222 | Medium | 6.5 | 2024-09-12 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-40655 | High | 7.8 | 2024-09-11 | In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a pe… |