CWE-276 · Incorrect Default Permissions (page 7)
Page 7 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27674 | High | 7.8 | 2024-04-03 | Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an unprivileged user can… |
CVE-2024-0259 | High | 7.3 | 2024-03-28 | Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the serv… |
CVE-2024-25958 | Medium | 6.7 | 2024-03-26 | Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated attacker could pote… |
CVE-2024-30204 | Low | 2.8 | 2024-03-25 | In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. |
CVE-2024-22085 | Medium | 6.2 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable. |
CVE-2024-25654 | Medium | 5.5 | 2024-03-18 | Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application serv… |
CVE-2024-1605 | Medium | 6.6 | 2024-03-18 | BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all… |
CVE-2024-28862 | Medium | 5.3 | 2024-03-16 | The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive d… |
CVE-2023-28389 | Medium | 6.7 | 2024-03-14 | Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalati… |
CVE-2024-20671 | Medium | 5.5 | 2024-03-12 | Microsoft Defender Security Feature Bypass Vulnerability |
CVE-2024-23295 | Medium | 5.5 | 2024-03-08 | A permissions issue was addressed to help ensure Personas are always protected. This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use… |
CVE-2024-23253 | Low | 3.3 | 2024-03-08 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to access a user's Photos Library. |
CVE-2024-23201 | Medium | 5.5 | 2024-03-08 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macO… |
CVE-2024-22889 | High | 7.5 | 2024-03-06 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request. |
CVE-2024-20841 | Medium | 5.1 | 2024-03-05 | Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data. |
CVE-2024-20830 | Medium | 5.3 | 2024-03-05 | Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings. |
CVE-2024-20005 | High | 8.2 | 2024-03-04 | In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-26280 | Medium | 4.7 | 2024-03-01 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag… |
CVE-2023-49338 | High | 7.5 | 2024-02-28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |
CVE-2024-26302 | Medium | 4.8 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2023-48678 | Medium | 5.5 | 2024-02-27 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before buil… |
CVE-2023-50975 | High | 8.4 | 2024-02-21 | The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i… |
CVE-2023-7235 | High | 8.4 | 2024-02-21 | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using… |
CVE-2023-42953 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An… |
CVE-2023-42945 | Medium | 5.5 | 2024-02-21 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth. |
CVE-2023-42928 | High | 7.8 | 2024-02-21 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated privileges. |
CVE-2024-1156 | High | 7.8 | 2024-02-20 | Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentia… |
CVE-2024-1155 | High | 7.8 | 2024-02-20 | Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalat… |
CVE-2024-25605 | Medium | 5.3 | 2024-02-20 | The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix p… |
CVE-2023-52379 | High | 7.5 | 2024-02-18 | Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-52362 | High | 7.5 | 2024-02-18 | Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability. |
CVE-2024-20921 | Medium | 5.9 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-0034 | High | 7.8 | 2024-02-16 | In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local esca… |
CVE-2024-1488 | High | 8.0 | 2024-02-15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configu… |
CVE-2023-49721 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2023-41231 | Medium | 6.7 | 2024-02-14 | Incorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentially enable escalatio… |
CVE-2023-40154 | Medium | 6.7 | 2024-02-14 | Incorrect default permissions in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow privillaged user to potentially enable escalation of… |
CVE-2023-34315 | Medium | 6.7 | 2024-02-14 | Incorrect default permissions in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2023-29162 | Medium | 6.0 | 2024-02-14 | Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privilege… |
CVE-2023-28739 | Medium | 6.7 | 2024-02-14 | Incorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable esc… |
CVE-2023-38960 | High | 7.3 | 2024-02-13 | Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via… |
CVE-2023-50236 | High | 7.8 | 2024-02-13 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the… |
CVE-2024-24828 | Medium | 6.6 | 2024-02-09 | pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix system… |
CVE-2024-22430 | Medium | 5.5 | 2024-02-01 | Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicious user could pote… |
CVE-2024-0833 | High | 7.8 | 2024-01-31 | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In a… |
CVE-2024-21840 | High | 7.9 | 2024-01-30 | Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affe… |
CVE-2023-29081 | Medium | 5.5 | 2024-01-26 | A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users… |
CVE-2024-22301 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: fro… |
CVE-2022-4964 | Medium | 5.5 | 2024-01-24 | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |
CVE-2024-0770 | Medium | 4.4 | 2024-01-21 | A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file… |
CVE-2023-29244 | Medium | 6.7 | 2024-01-19 | Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before vers… |
CVE-2024-22409 | High | 7.5 | 2024-01-16 | DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile… |
CVE-2024-22428 | High | 7.0 | 2024-01-16 | Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escal… |
CVE-2023-6457 | Medium | 6.6 | 2024-01-16 | Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write… |
CVE-2024-23301 | Medium | 5.5 | 2024-01-12 | Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets… |
CVE-2022-45793 | Medium | 5.5 | 2024-01-10 | Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result i… |
CVE-2023-50612 | High | 7.8 | 2024-01-06 | Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive informatio… |
CVE-2023-5536 | Medium | 5.0 | 2023-12-12 | A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to… |
CVE-2021-3187 | High | 8.8 | 2023-12-11 | An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicio… |
CVE-2023-28870 | Medium | 6.5 | 2023-12-09 | Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged… |
CVE-2023-6273 | Medium | 5.3 | 2023-12-06 | Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abno… |
CVE-2023-46773 | Critical | 9.8 | 2023-12-06 | Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2023-37572 | High | 7.5 | 2023-12-05 | Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery… |
CVE-2023-40076 | Medium | 5.5 | 2023-12-04 | In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due to a permissions bypass. This could lead… |
CVE-2023-21216 | Critical | 9.8 | 2023-12-04 | In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation… |
CVE-2023-47462 | Critical | 9.8 | 2023-11-29 | Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function. |
CVE-2023-42501 | Medium | 4.3 | 2023-11-27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache… |
CVE-2023-6302 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the… |
CVE-2023-47250 | High | 8.8 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to… |
CVE-2023-43081 | Medium | 4.0 | 2023-11-22 | PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. A low Privileged loc… |
CVE-2023-42774 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions. |
CVE-2023-3116 | High | 7.3 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. |
CVE-2023-40363 | High | 8.1 | 2023-11-18 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force I… |
CVE-2023-48648 | Critical | 9.8 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation function… |
CVE-2023-47335 | Medium | 6.5 | 2023-11-16 | Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones. |
CVE-2023-41718 | High | 7.8 | 2023-11-15 | When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a… |
CVE-2023-35080 | High | 7.8 | 2023-11-15 | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable conf… |
CVE-2023-32638 | Medium | 6.7 | 2023-11-14 | Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially enable escalation of… |
CVE-2023-27305 | Medium | 6.7 | 2023-11-14 | Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable escala… |
CVE-2023-23583 | High | 8.8 | 2023-11-14 | Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation o… |
CVE-2023-46743 | High | 7.3 | 2023-11-09 | application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a docu… |
CVE-2023-4706 | High | 7.3 | 2023-11-08 | A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrec… |
CVE-2023-43984 | High | 7.5 | 2023-11-07 | Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer t… |
CVE-2023-41726 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability |
CVE-2023-4091 | Medium | 6.5 | 2023-11-03 | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xa… |
CVE-2022-4575 | Medium | 6.7 | 2023-10-30 | A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or l… |
CVE-2023-5623 | High | 7.0 | 2023-10-26 | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM… |
CVE-2023-45990 | High | 8.0 | 2023-10-25 | Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges. |
CVE-2023-3112 | High | 7.8 | 2023-10-25 | A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with el… |
CVE-2022-42150 | Critical | 10.0 | 2023-10-19 | TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape. |
CVE-2023-35183 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resour… |
CVE-2023-35181 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permissio… |
CVE-2023-27133 | Critical | 9.8 | 2023-10-17 | TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may en… |
CVE-2023-45690 | Medium | 4.9 | 2023-10-16 | Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive… |
CVE-2023-44194 | High | 8.4 | 2023-10-13 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a bac… |
CVE-2022-3431 | Medium | 6.7 | 2023-10-09 | A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow… |
CVE-2023-3440 | High | 8.4 | 2023-10-03 | Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Manage… |
CVE-2023-4065 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. T… |
CVE-2023-44157 | High | 7.8 | 2023-09-27 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 35979. |
CVE-2022-4039 | High | 8.0 | 2023-09-22 | A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allow… |