CWE-276 · Incorrect Default Permissions (page 8)
Page 8 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33745 | Critical | 9.8 | 2023-07-27 | TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering th… |
CVE-2023-38410 | High | 7.8 | 2023-07-27 | The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to elevate privileges. |
CVE-2023-3323 | Medium | 5.9 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-26077 | High | 7.8 | 2023-07-24 | Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions. |
CVE-2023-38335 | Medium | 5.3 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversibl… |
CVE-2023-38334 | Medium | 6.5 | 2023-07-20 | Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer po… |
CVE-2023-31462 | High | 8.8 | 2023-07-20 | An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users on the computer, in o… |
CVE-2020-36695 | Medium | 6.6 | 2023-07-18 | Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hita… |
CVE-2023-29131 | High | 7.4 | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of an incorrect default value in the SSH configuration… |
CVE-2023-32183 | High | 7.8 | 2023-07-07 | Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue a… |
CVE-2023-21513 | Medium | 6.1 | 2023-06-28 | Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that re… |
CVE-2023-21512 | Low | 2.4 | 2023-06-28 | Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without p… |
CVE-2023-21187 | High | 7.8 | 2023-06-28 | In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in the code. This could lead to local esca… |
CVE-2023-21175 | High | 7.8 | 2023-06-28 | In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass. This could lead… |
CVE-2023-20178 | High | 7.8 | 2023-06-28 | A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could… |
CVE-2023-30902 | Medium | 5.5 | 2023-06-26 | A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privile… |
CVE-2023-32407 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, ma… |
CVE-2023-32405 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to… |
CVE-2023-32404 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved entitlements. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. An app may be able to by… |
CVE-2023-32399 | Medium | 5.5 | 2023-06-23 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app m… |
CVE-2023-32351 | High | 7.8 | 2023-06-23 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated privileges. |
CVE-2023-23344 | Low | 3.0 | 2023-06-23 | A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. |
CVE-2023-30905 | High | 7.8 | 2023-06-16 | The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. |
CVE-2023-25645 | High | 7.7 | 2023-06-16 | There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform… |
CVE-2023-21139 | High | 7.8 | 2023-06-15 | In bindPlayer of MediaControlPanel.java, there is a possible launch arbitrary activity in SysUI due to Unsafe Intent. This could lead to local escalation of pr… |
CVE-2023-21138 | High | 7.8 | 2023-06-15 | In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalat… |
CVE-2023-21129 | High | 7.8 | 2023-06-15 | In getFullScreenIntentDecision of NotificationInterruptStateProviderImpl.java, there is a possible activity launch while the app is in the background due to a… |
CVE-2023-21128 | High | 7.8 | 2023-06-15 | In various functions of AppStandbyController.java, there is a possible way to break manageability scenarios due to a logic error in the code. This could lead t… |
CVE-2023-21126 | High | 7.8 | 2023-06-15 | In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under SysUI due to Unsafe Intent. This could l… |
CVE-2023-21121 | High | 7.8 | 2023-06-15 | In onResume of AppManagementFragment.java, there is a possible way to prevent users from forgetting a previously connected VPN due to improper input validation… |
CVE-2022-33877 | High | 7.0 | 2023-06-13 | An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windo… |
CVE-2023-32221 | High | 8.8 | 2023-06-12 | EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation. |
CVE-2023-31116 | Critical | 9.8 | 2023-06-07 | An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause unintended querying of RC… |
CVE-2023-33282 | Critical | 9.8 | 2023-06-07 | Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This ma… |
CVE-2022-4569 | High | 7.8 | 2023-06-05 | A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execu… |
CVE-2023-33966 | High | 8.6 | 2023-05-31 | Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:h… |
CVE-2023-2749 | High | 8.6 | 2023-05-31 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensiti… |
CVE-2023-29733 | High | 7.8 | 2023-05-30 | The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app… |
CVE-2023-29732 | Critical | 9.8 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the… |
CVE-2023-29731 | High | 7.5 | 2023-05-30 | SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method… |
CVE-2023-28079 | High | 7.0 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains Insecure File and Folder Permissions vulnerability. A regular user (non-admin) can exploit the weak fo… |
CVE-2022-45853 | Medium | 6.7 | 2023-05-30 | The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an… |
CVE-2023-32698 | High | 7.1 | 2023-05-30 | nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for… |
CVE-2023-33291 | High | 7.4 | 2023-05-28 | In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone… |
CVE-2023-29919 | Critical | 9.1 | 2023-05-23 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted. |
CVE-2023-29838 | High | 7.8 | 2023-05-22 | Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the SyncService.exe fil… |
CVE-2023-1693 | High | 7.5 | 2023-05-20 | The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-33240 | High | 7.8 | 2023-05-19 | Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and… |
CVE-2022-45459 | High | 7.5 | 2023-05-18 | Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis… |
CVE-2022-45452 | High | 7.8 | 2023-05-18 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber P… |
CVE-2023-30281 | Medium | 6.5 | 2023-05-16 | Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaSho… |
CVE-2023-32999 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-32996 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requ… |
CVE-2023-21107 | High | 7.8 | 2023-05-15 | In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local escalation of privilege across user bounda… |
CVE-2023-21104 | Medium | 5.5 | 2023-05-15 | In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure with no additional execution privileges… |
CVE-2023-27382 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an auth… |
CVE-2023-22440 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user to potentially enab… |
CVE-2022-41687 | Medium | 6.7 | 2023-05-10 | Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an auth… |
CVE-2022-40971 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable… |
CVE-2022-36391 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation o… |
CVE-2022-33963 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the software installer for Intel(R) Unite(R) Client software for Windows before version 4.2.34870 may allow an authenticated u… |
CVE-2022-30338 | Medium | 6.7 | 2023-05-10 | Incorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2023-28192 | Medium | 5.5 | 2023-05-08 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may… |
CVE-2023-23059 | Critical | 9.8 | 2023-05-04 | An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and all… |
CVE-2023-22651 | Critical | 9.9 | 2023-05-04 | Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead… |
CVE-2023-28724 | High | 7.1 | 2023-05-03 | NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and… |
CVE-2022-30759 | High | 8.8 | 2023-05-02 | In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute a… |
CVE-2023-1809 | High | 7.5 | 2023-05-02 | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary passw… |
CVE-2023-27035 | Medium | 6.5 | 2023-05-01 | An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedde… |
CVE-2022-4568 | High | 7.0 | 2023-05-01 | A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2022-38583 | High | 7.8 | 2023-04-28 | On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privile… |
CVE-2021-23166 | High | 8.7 | 2023-04-25 | A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on… |
CVE-2022-31244 | High | 7.8 | 2023-04-25 | Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation. |
CVE-2023-29923 | Medium | 5.3 | 2023-04-19 | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. |
CVE-2021-41614 | High | 7.8 | 2023-04-18 | An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (E… |
CVE-2023-28966 | High | 7.8 | 2023-04-17 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing… |
CVE-2023-27647 | High | 7.1 | 2023-04-14 | An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive information via the com.ludashi.superloc… |
CVE-2023-26918 | Critical | 9.8 | 2023-04-14 | Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSys… |
CVE-2023-22951 | High | 8.8 | 2023-04-13 | An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the… |
CVE-2023-25542 | High | 7.0 | 2023-04-06 | Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An unauthenticated local attacker could pot… |
CVE-2020-21514 | High | 8.8 | 2023-04-04 | An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password. |
CVE-2023-25355 | High | 8.8 | 2023-04-04 | CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom… |
CVE-2023-25941 | High | 7.8 | 2023-04-04 | Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentially exploit this v… |
CVE-2023-0181 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, wh… |
CVE-2022-48360 | High | 7.5 | 2023-03-27 | The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2023-27593 | Medium | 4.4 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with acce… |
CVE-2022-46774 | Medium | 5.4 | 2023-03-15 | IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to… |
CVE-2022-3758 | Medium | 5.4 | 2023-03-09 | An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions sta… |
CVE-2023-1229 | Medium | 4.3 | 2023-03-07 | Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2021-36400 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
CVE-2021-36397 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
CVE-2022-45552 | High | 7.5 | 2023-03-03 | An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bu… |
CVE-2023-25540 | Medium | 6.0 | 2023-02-28 | Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability to… |
CVE-2022-3884 | High | 7.3 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to… |
CVE-2020-36652 | Medium | 6.6 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure… |
CVE-2022-40232 | Medium | 6.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have ac… |