CWE-276 · Incorrect Default Permissions (page 9)
Page 9 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26918 | Critical | 9.8 | 2023-04-14 | Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSys… |
CVE-2023-22951 | High | 8.8 | 2023-04-13 | An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the… |
CVE-2023-25542 | High | 7.0 | 2023-04-06 | Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An unauthenticated local attacker could pot… |
CVE-2020-21514 | High | 8.8 | 2023-04-04 | An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password. |
CVE-2023-25355 | High | 8.8 | 2023-04-04 | CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the `daemon` user on a sipXcom… |
CVE-2023-25941 | High | 7.8 | 2023-04-04 | Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local attacker could potentially exploit this v… |
CVE-2023-0181 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, wh… |
CVE-2022-48360 | High | 7.5 | 2023-03-27 | The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2023-27593 | Medium | 4.4 | 2023-03-17 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with acce… |
CVE-2022-46774 | Medium | 5.4 | 2023-03-15 | IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to… |
CVE-2022-3758 | Medium | 5.4 | 2023-03-09 | An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions sta… |
CVE-2023-1229 | Medium | 4.3 | 2023-03-07 | Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2021-36400 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
CVE-2021-36397 | Medium | 5.3 | 2023-03-06 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
CVE-2022-45552 | High | 7.5 | 2023-03-03 | An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bu… |
CVE-2023-25540 | Medium | 6.0 | 2023-02-28 | Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability to… |
CVE-2022-3884 | High | 7.3 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to… |
CVE-2020-36652 | Medium | 6.6 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure… |
CVE-2022-40232 | Medium | 6.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have ac… |
CVE-2021-34182 | Critical | 9.8 | 2023-02-17 | An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. |
CVE-2021-34164 | High | 8.8 | 2023-02-17 | Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/ema… |
CVE-2022-36397 | High | 7.3 | 2023-02-16 | Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentia… |
CVE-2022-33196 | High | 7.2 | 2023-02-16 | Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which… |
CVE-2023-23850 | Medium | 4.3 | 2023-02-15 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-23848 | Medium | 4.3 | 2023-02-15 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2022-45153 | High | 7.0 | 2023-02-15 | An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise S… |
CVE-2023-22931 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RS… |
CVE-2022-45454 | High | 7.5 | 2023-02-13 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis C… |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2022-31254 | High | 7.8 | 2023-02-07 | A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP… |
CVE-2022-23454 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-23453 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-45099 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit… |
CVE-2022-48199 | High | 8.8 | 2023-01-26 | SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privileged user account that… |
CVE-2022-47040 | High | 7.8 | 2023-01-26 | An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a cra… |
CVE-2022-3432 | Medium | 6.7 | 2023-01-26 | A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker wit… |
CVE-2022-20456 | High | 7.8 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local… |
CVE-2022-3430 | Medium | 6.7 | 2023-01-23 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot… |
CVE-2022-1109 | Medium | 5.5 | 2023-01-20 | An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. |
CVE-2023-20043 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2022-45924 | High | 8.1 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete… |
CVE-2020-36611 | Medium | 6.6 | 2023-01-17 | Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi… |
CVE-2023-23566 | Critical | 9.8 | 2023-01-13 | A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to an… |
CVE-2022-46761 | High | 7.5 | 2023-01-06 | The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hidin… |
CVE-2021-4297 | Medium | 5.5 | 2023-01-01 | A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file appli… |
CVE-2019-9579 | High | 8.1 | 2022-12-26 | An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g… |
CVE-2022-3155 | High | 7.8 | 2022-12-22 | When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an a… |
CVE-2022-29909 | High | 8.8 | 2022-12-22 | Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wr… |
CVE-2022-47551 | Medium | 6.5 | 2022-12-20 | Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman pro… |
CVE-2022-20611 | High | 7.8 | 2022-12-13 | In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bypass. This could l… |
CVE-2022-20495 | High | 7.8 | 2022-12-13 | In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code… |
CVE-2022-20475 | High | 7.8 | 2022-12-13 | In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused deputy. This could lea… |
CVE-2022-20474 | High | 7.8 | 2022-12-13 | In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local… |
CVE-2022-42446 | Medium | 6.5 | 2022-12-12 | Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and… |
CVE-2022-37018 | High | 8.4 | 2022-12-12 | A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is… |
CVE-2022-1038 | High | 7.8 | 2022-12-12 | A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that custome… |
CVE-2021-3437 | Critical | 9.8 | 2022-12-12 | Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. HP… |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-46382 | High | 8.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing… |
CVE-2022-27773 | Critical | 9.8 | 2022-12-05 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. |
CVE-2022-45562 | High | 8.8 | 2022-12-02 | Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privi… |
CVE-2022-44929 | Critical | 9.8 | 2022-12-02 | An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles. |
CVE-2022-42718 | High | 7.8 | 2022-12-01 | Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable esca… |
CVE-2022-4020 | High | 8.1 | 2022-11-28 | Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot set… |
CVE-2022-41943 | Critical | 9.0 | 2022-11-22 | sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch`… |
CVE-2022-42130 | Medium | 4.3 | 2022-11-15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, a… |
CVE-2022-42128 | Medium | 5.3 | 2022-11-15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attack… |
CVE-2022-42127 | Medium | 5.3 | 2022-11-15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allo… |
CVE-2022-36377 | Medium | 6.7 | 2022-11-11 | Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Wi… |
CVE-2022-36367 | Medium | 4.4 | 2022-11-11 | Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informatio… |
CVE-2022-44561 | High | 7.5 | 2022-11-09 | The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary wid… |
CVE-2022-44557 | High | 7.5 | 2022-11-09 | The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vul… |
CVE-2022-44554 | High | 7.5 | 2022-11-09 | The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the dev… |
CVE-2022-44548 | Medium | 4.3 | 2022-11-09 | There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may cause the dialog bo… |
CVE-2022-34824 | Critical | 9.8 | 2022-11-08 | Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Sing… |
CVE-2022-20465 | Medium | 4.6 | 2022-11-08 | In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code… |
CVE-2022-20452 | High | 7.8 | 2022-11-08 | In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escala… |
CVE-2022-20448 | Medium | 5.5 | 2022-11-08 | In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to l… |
CVE-2022-20441 | High | 7.8 | 2022-11-08 | In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalat… |
CVE-2022-43574 | High | 7.5 | 2022-11-03 | "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to applica… |
CVE-2020-36605 | Medium | 6.6 | 2022-11-01 | Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Li… |
CVE-2022-33182 | High | 7.8 | 2022-10-25 | A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated use… |
CVE-2020-5355 | Medium | 4.3 | 2022-10-21 | The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. This provides the re… |
CVE-2013-4281 | Medium | 5.5 | 2022-10-19 | In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with loca… |
CVE-2022-36439 | Medium | 6.0 | 2022-10-18 | AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and… |
CVE-2022-36438 | High | 7.8 | 2022-10-18 | AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also can be used to delete… |
CVE-2022-3368 | High | 7.3 | 2022-10-17 | A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate hi… |
CVE-2022-42464 | Medium | 6.7 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact… |
CVE-2022-36803 | High | 8.8 | 2022-10-14 | The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the Maste… |
CVE-2022-40187 | High | 8.0 | 2022-10-13 | Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces… |
CVE-2022-33922 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vu… |
CVE-2022-20436 | High | 7.8 | 2022-10-11 | There is an unauthorized service in the system service. Since the component does not have permission check, resulting in Local Elevation of privilege.Product… |
CVE-2022-20435 | High | 7.8 | 2022-10-11 | There is a Unauthorized service in the system service, may cause the system reboot. Since the component does not have permission check and permission protectio… |
CVE-2022-41748 | Medium | 6.7 | 2022-10-10 | A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials… |
CVE-2022-41414 | Medium | 5.3 | 2022-10-07 | An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and… |
CVE-2022-26235 | High | 7.8 | 2022-10-06 | A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advan… |
CVE-2022-3263 | High | 7.8 | 2022-09-23 | The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modi… |
CVE-2021-46834 | Medium | 5.5 | 2022-09-20 | A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected p… |