CWE-276 · Incorrect Default Permissions (page 8)
Page 8 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42261 | High | 7.5 | 2023-09-21 | Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not… |
CVE-2023-43496 | High | 8.8 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created fi… |
CVE-2023-5042 | High | 7.5 | 2023-09-20 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2023-4088 | Critical | 9.3 | 2023-09-20 | Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to e… |
CVE-2022-3466 | Medium | 4.8 | 2023-09-15 | The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, r… |
CVE-2023-4664 | High | 8.8 | 2023-09-15 | Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. |
CVE-2023-37878 | Medium | 6.1 | 2023-09-12 | Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0. |
CVE-2023-31468 | High | 7.8 | 2023-09-11 | An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permission… |
CVE-2023-31068 | Critical | 9.8 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)… |
CVE-2023-31067 | Critical | 9.8 | 2023-09-11 | An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)… |
CVE-2023-34352 | Medium | 5.3 | 2023-09-06 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 1… |
CVE-2023-2737 | Medium | 5.7 | 2023-08-16 | Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local pri… |
CVE-2023-32492 | Medium | 5.3 | 2023-08-16 | Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker could potentially exploit this vulnerab… |
CVE-2023-32663 | Medium | 6.7 | 2023-08-11 | Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2023-32547 | Medium | 6.7 | 2023-08-11 | Incorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to potentially enable esca… |
CVE-2023-32543 | Medium | 6.7 | 2023-08-11 | Incorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation of privilege via loc… |
CVE-2023-31246 | Medium | 6.7 | 2023-08-11 | Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of… |
CVE-2023-27505 | Medium | 6.7 | 2023-08-11 | Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow an authenticated us… |
CVE-2023-27392 | Medium | 4.4 | 2023-08-11 | Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentially enable informatio… |
CVE-2022-43702 | High | 7.8 | 2023-07-27 | When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execu… |
CVE-2022-43701 | High | 7.8 | 2023-07-27 | When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause ex… |
CVE-2023-33745 | Critical | 9.8 | 2023-07-27 | TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering th… |
CVE-2023-38410 | High | 7.8 | 2023-07-27 | The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to elevate privileges. |
CVE-2023-3323 | Medium | 5.9 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-26077 | High | 7.8 | 2023-07-24 | Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2023-38335 | Medium | 5.3 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversibl… |
CVE-2023-38334 | Medium | 6.5 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer po… |
CVE-2023-31462 | High | 8.8 | 2023-07-20 | An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users on the computer, in o… |
CVE-2020-36695 | Medium | 6.6 | 2023-07-18 | Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hita… |
CVE-2023-29131 | High | 7.4 | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of an incorrect default value in the SSH configuration… |
CVE-2023-32183 | High | 7.8 | 2023-07-07 | Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue a… |
CVE-2023-21513 | Medium | 6.1 | 2023-06-28 | Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that re… |
CVE-2023-21512 | Low | 2.4 | 2023-06-28 | Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without p… |
CVE-2023-21187 | High | 7.8 | 2023-06-28 | In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in the code. This could lead to local esca… |
CVE-2023-21175 | High | 7.8 | 2023-06-28 | In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass. This could lead… |
CVE-2023-20178 | High | 7.8 | 2023-06-28 | A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could… |
CVE-2023-30902 | Medium | 5.5 | 2023-06-26 | A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privile… |
CVE-2023-32407 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, ma… |
CVE-2023-32405 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to… |
CVE-2023-32404 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved entitlements. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. An app may be able to by… |
CVE-2023-32399 | Medium | 5.5 | 2023-06-23 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app m… |
CVE-2023-32351 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated privileges. |
CVE-2023-23344 | Low | 3.0 | 2023-06-23 | A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. |
CVE-2023-30905 | High | 7.8 | 2023-06-16 | The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. |
CVE-2023-25645 | High | 7.7 | 2023-06-16 | There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform… |
CVE-2023-21139 | High | 7.8 | 2023-06-15 | In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent. This could lead to local escalation of pr… |
CVE-2023-21138 | High | 7.8 | 2023-06-15 | In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalat… |
CVE-2023-21129 | High | 7.8 | 2023-06-15 | In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the background due to a… |
CVE-2023-21128 | High | 7.8 | 2023-06-15 | In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead t… |
CVE-2023-21126 | High | 7.8 | 2023-06-15 | In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under SysUI due to Unsafe Intent. This could l… |
CVE-2023-21121 | High | 7.8 | 2023-06-15 | In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to improper input validation… |
CVE-2022-33877 | High | 7.0 | 2023-06-13 | An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windo… |
CVE-2023-32221 | High | 8.8 | 2023-06-12 | EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation. |
CVE-2023-31116 | Critical | 9.8 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause unintended querying of RC… |
CVE-2023-33282 | Critical | 9.8 | 2023-06-07 | Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This ma… |
CVE-2022-4569 | High | 7.8 | 2023-06-05 | A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execu… |
CVE-2023-33966 | High | 8.6 | 2023-05-31 | Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:h… |
CVE-2023-2749 | High | 8.6 | 2023-05-31 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensiti… |
CVE-2023-29733 | High | 7.8 | 2023-05-30 | The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app… |
CVE-2023-29732 | Critical | 9.8 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the… |
CVE-2023-29731 | High | 7.5 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method… |
CVE-2023-28079 | High | 7.0 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular user (non-admin) can exploit the weak fo… |
CVE-2022-45853 | Medium | 6.7 | 2023-05-30 | The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an… |
CVE-2023-32698 | High | 7.1 | 2023-05-30 | nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for… |
CVE-2023-33291 | High | 7.4 | 2023-05-28 | In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone… |
CVE-2023-29919 | Critical | 9.1 | 2023-05-23 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted. |
CVE-2023-29838 | High | 7.8 | 2023-05-22 | Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the SyncService.exe fil… |
CVE-2023-1693 | High | 7.5 | 2023-05-20 | The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-33240 | High | 7.8 | 2023-05-19 | Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and… |
CVE-2022-45459 | High | 7.5 | 2023-05-18 | Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis… |
CVE-2022-45452 | High | 7.8 | 2023-05-18 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber P… |
CVE-2023-30281 | Medium | 6.5 | 2023-05-16 | Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaSho… |
CVE-2023-32999 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-32996 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requ… |
CVE-2023-21107 | High | 7.8 | 2023-05-15 | In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local escalation of privilege across user bounda… |
CVE-2023-21104 | Medium | 5.5 | 2023-05-15 | In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure with no additional execution privileges… |
CVE-2023-27382 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an auth… |
CVE-2023-22440 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enab… |
CVE-2022-41687 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an auth… |
CVE-2022-40971 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable… |
CVE-2022-36391 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2022-33963 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the software installer for Intel(R) Unite(R) Client software for Windows before version 4.2.34870 may allow an authenticated u… |
CVE-2022-30338 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-28192 | Medium | 5.5 | 2023-05-08 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may… |
CVE-2023-23059 | Critical | 9.8 | 2023-05-04 | An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and all… |
CVE-2023-22651 | Critical | 9.9 | 2023-05-04 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead… |
CVE-2023-28724 | High | 7.1 | 2023-05-03 | NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and… |
CVE-2022-30759 | High | 8.8 | 2023-05-02 | In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute a… |
CVE-2023-1809 | High | 7.5 | 2023-05-02 | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary passw… |
CVE-2023-27035 | Medium | 6.5 | 2023-05-01 | An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedde… |
CVE-2022-4568 | High | 7.0 | 2023-05-01 | A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2022-38583 | High | 7.8 | 2023-04-28 | On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privile… |
CVE-2021-23166 | High | 8.7 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on… |
CVE-2022-31244 | High | 7.8 | 2023-04-25 | Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation. |
CVE-2023-29923 | Medium | 5.3 | 2023-04-19 | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. |
CVE-2021-41614 | High | 7.8 | 2023-04-18 | An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (E… |
CVE-2023-28966 | High | 7.8 | 2023-04-17 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing… |
CVE-2023-27647 | High | 7.1 | 2023-04-14 | An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive information via the com.ludashi.superloc… |