CWE-276 · Incorrect Default Permissions (page 6)
Page 6 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40654 | High | 7.8 | 2024-09-11 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-34661 | Medium | 4.3 | 2024-09-04 | Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction… |
CVE-2024-34648 | Medium | 5.1 | 2024-09-04 | Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34018 | Medium | 5.5 | 2024-08-29 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-44760 | High | 7.5 | 2024-08-28 | Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to acce… |
CVE-2023-45896 | High | 7.1 | 2024-08-28 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… |
CVE-2024-43791 | High | 7.8 | 2024-08-23 | RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are worl… |
CVE-2024-4763 | High | 7.8 | 2024-08-16 | An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a lo… |
CVE-2024-2175 | High | 7.8 | 2024-08-16 | An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow… |
CVE-2024-42681 | High | 8.8 | 2024-08-15 | Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. |
CVE-2024-27461 | Medium | 5.6 | 2024-08-14 | Incorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2024-26025 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-23974 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2024-23495 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable esca… |
CVE-2024-22378 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated u… |
CVE-2023-43747 | Medium | 6.7 | 2024-08-14 | Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authenticated user to potent… |
CVE-2023-31349 | High | 7.3 | 2024-08-13 | Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitra… |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-34617 | Medium | 4.0 | 2024-08-07 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application. |
CVE-2024-34616 | Medium | 5.1 | 2024-08-07 | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-7525 | High | 8.1 | 2024-08-06 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on… |
CVE-2024-43114 | High | 7.5 | 2024-08-06 | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions |
CVE-2024-6974 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. |
CVE-2024-40805 | High | 7.1 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An… |
CVE-2024-27888 | Medium | 5.5 | 2024-07-29 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An app may be able to mod… |
CVE-2024-42053 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-36541 | High | 8.8 | 2024-07-24 | Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-6122 | Medium | 5.5 | 2024-07-22 | An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via loc… |
CVE-2024-5321 | Medium | 6.1 | 2024-07-18 | A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated… |
CVE-2024-21123 | Low | 2.3 | 2024-07-16 | Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnera… |
CVE-2024-21122 | Medium | 5.4 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog). The supported version that is affect… |
CVE-2024-6326 | Medium | 5.5 | 2024-07-16 | An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerabi… |
CVE-2024-6325 | Medium | 6.5 | 2024-07-16 | The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/a… |
CVE-2024-32861 | High | 7.8 | 2024-07-16 | Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions. |
CVE-2024-3779 | Medium | 6.1 | 2024-07-16 | Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inoper… |
CVE-2024-6148 | High | 8.8 | 2024-07-10 | Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 |
CVE-2024-31312 | Medium | 5.5 | 2024-07-09 | In multiple locations, there is a possible information leak due to a missing permission check. This could lead to local information disclosure exposing played… |
CVE-2024-22062 | Medium | 6.3 | 2024-07-09 | There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by m… |
CVE-2024-3904 | High | 8.8 | 2024-07-04 | Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows… |
CVE-2024-4679 | High | 7.8 | 2024-07-02 | Incorrect Default Permissions vulnerability in Hitachi JP1/Extensible SNMP Agent for Windows, Hitachi JP1/Extensible SNMP Agent on Windows, Hitachi Job Managem… |
CVE-2024-2819 | Medium | 5.1 | 2024-07-02 | Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue aff… |
CVE-2024-35139 | Medium | 6.2 | 2024-06-28 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect defau… |
CVE-2024-39347 | Medium | 5.9 | 2024-06-28 | Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-… |
CVE-2023-38370 | High | 7.5 | 2024-06-27 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. I… |
CVE-2024-6238 | High | 7.4 | 2024-06-25 | pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on t… |
CVE-2024-22385 | Medium | 4.4 | 2024-06-25 | Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affec… |
CVE-2024-36495 | High | 7.7 | 2024-06-24 | The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write… |
CVE-2024-5967 | Low | 2.7 | 2024-06-18 | A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured… |
CVE-2024-38459 | High | 7.8 | 2024-06-16 | langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists bec… |
CVE-2024-34012 | Medium | 4.4 | 2024-06-14 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272. |
CVE-2024-27180 | Medium | 6.7 | 2024-06-14 | An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27171 | High | 7.4 | 2024-06-14 | A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products… |
CVE-2024-27167 | High | 7.4 | 2024-06-14 | Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject a malicious Sendmai… |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-27155 | High | 7.7 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-27153 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27152 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27151 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-27150 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27149 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27148 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27144 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the… |
CVE-2024-37038 | High | 7.5 | 2024-06-12 | CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unautho… |
CVE-2024-23847 | Medium | 5.9 | 2024-05-31 | Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem pri… |
CVE-2024-32978 | Medium | 6.6 | 2024-05-27 | Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified… |
CVE-2024-27264 | High | 7.4 | 2024-05-22 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2023-43629 | High | 7.8 | 2024-05-16 | Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2023-42668 | Medium | 6.7 | 2024-05-16 | Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chipset may allow an a… |
CVE-2023-42433 | Medium | 6.7 | 2024-05-16 | Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable… |
CVE-2023-24460 | High | 8.2 | 2024-05-16 | Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2024-34223 | Medium | 4.3 | 2024-05-14 | Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve or reject leave ti… |
CVE-2024-34221 | High | 8.8 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation. |
CVE-2023-46870 | High | 7.3 | 2024-05-14 | extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, a… |
CVE-2024-4030 | High | 7.1 | 2024-05-07 | On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other… |
CVE-2024-34474 | High | 7.8 | 2024-05-05 | Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. |
CVE-2024-34455 | High | 7.5 | 2024-05-03 | Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2. |
CVE-2024-4226 | Low | 3.5 | 2024-04-30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This fu… |
CVE-2024-34011 | Medium | 6.8 | 2024-04-29 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37… |
CVE-2023-46270 | Low | 3.3 | 2024-04-29 | MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items. |
CVE-2022-48685 | High | 7.7 | 2024-04-27 | An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leadi… |
CVE-2024-2859 | Medium | 6.8 | 2024-04-27 | By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should… |
CVE-2023-23976 | High | 7.5 | 2024-04-24 | Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects R… |
CVE-2023-38295 | High | 7.8 | 2024-04-22 | Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permission that provides no… |
CVE-2023-38294 | Medium | 6.1 | 2024-04-22 | Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory… |
CVE-2023-38291 | High | 7.1 | 2024-04-22 | An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. Various software buil… |
CVE-2024-32368 | High | 7.3 | 2024-04-22 | Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a denial of service via t… |
CVE-2024-29967 | Medium | 4.4 | 2024-04-19 | In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing read… |
CVE-2024-29962 | Medium | 5.5 | 2024-04-19 | Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without th… |
CVE-2024-21116 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21012 | Low | 3.7 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2024-21004 | Low | 2.5 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-21002 | Low | 2.5 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-28056 | Critical | 9.8 | 2024-04-15 | Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication compo… |
CVE-2024-21615 | Medium | 5.0 | 2024-04-12 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential… |
CVE-2024-31442 | High | 8.8 | 2024-04-08 | Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, includin… |
CVE-2024-26574 | High | 7.8 | 2024-04-08 | Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script to the WSNativePushS… |
CVE-2023-52545 | High | 7.5 | 2024-04-08 | Vulnerability of undefined permissions in the Calendar app. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52717 | Medium | 5.3 | 2024-04-07 | Permission verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30415 | Critical | 9.1 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30977 | High | 7.8 | 2024-04-05 | An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the password component. |