CWE-276 · Incorrect Default Permissions (page 9)
Page 9 of 16 — CVEs classified under CWE-276, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34182 | Critical | 9.8 | 2023-02-17 | An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. |
CVE-2021-34164 | High | 8.8 | 2023-02-17 | Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/ema… |
CVE-2022-36397 | High | 7.3 | 2023-02-16 | Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentia… |
CVE-2022-33196 | High | 7.2 | 2023-02-16 | Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which… |
CVE-2023-23850 | Medium | 4.3 | 2023-02-15 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-23848 | Medium | 4.3 | 2023-02-15 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2022-45153 | High | 7.0 | 2023-02-15 | An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise S… |
CVE-2023-22931 | Medium | 4.3 | 2023-02-14 | In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RS… |
CVE-2022-45454 | High | 7.5 | 2023-02-13 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis C… |
CVE-2023-21433 | High | 7.8 | 2023-02-09 | Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy Store. |
CVE-2022-31254 | High | 7.8 | 2023-02-07 | A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP… |
CVE-2022-23454 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-23453 | High | 7.8 | 2023-02-01 | Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, a… |
CVE-2022-45099 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit… |
CVE-2022-48199 | High | 8.8 | 2023-01-26 | SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privileged user account that… |
CVE-2022-47040 | High | 7.8 | 2023-01-26 | An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a cra… |
CVE-2022-3432 | Medium | 6.7 | 2023-01-26 | A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker wit… |
CVE-2022-20456 | High | 7.8 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local… |
CVE-2022-3430 | Medium | 6.7 | 2023-01-23 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot… |
CVE-2022-1109 | Medium | 5.5 | 2023-01-20 | An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. |
CVE-2023-20043 | Medium | 6.7 | 2023-01-20 | A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure f… |
CVE-2022-45924 | High | 8.1 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete… |
CVE-2020-36611 | Medium | 6.6 | 2023-01-17 | Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi… |
CVE-2023-23566 | Critical | 9.8 | 2023-01-13 | A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to an… |
CVE-2022-46761 | High | 7.5 | 2023-01-06 | The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hidin… |
CVE-2021-4297 | Medium | 5.5 | 2023-01-01 | A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file appli… |
CVE-2019-9579 | High | 8.1 | 2022-12-26 | An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g… |
CVE-2022-3155 | High | 7.8 | 2022-12-22 | When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an a… |
CVE-2022-29909 | High | 8.8 | 2022-12-22 | Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wr… |
CVE-2022-47551 | Medium | 6.5 | 2022-12-20 | Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman pro… |
CVE-2022-20611 | High | 7.8 | 2022-12-13 | In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bypass. This could l… |
CVE-2022-20495 | High | 7.8 | 2022-12-13 | In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code… |
CVE-2022-20475 | High | 7.8 | 2022-12-13 | In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused deputy. This could lea… |
CVE-2022-20474 | High | 7.8 | 2022-12-13 | In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local… |
CVE-2022-42446 | Medium | 6.5 | 2022-12-12 | Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and… |
CVE-2022-37018 | High | 8.4 | 2022-12-12 | A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is… |
CVE-2022-1038 | High | 7.8 | 2022-12-12 | A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that custome… |
CVE-2021-3437 | Critical | 9.8 | 2022-12-12 | Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. HP… |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-46382 | High | 8.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing… |
CVE-2022-27773 | Critical | 9.8 | 2022-12-05 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. |
CVE-2022-45562 | High | 8.8 | 2022-12-02 | Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privi… |
CVE-2022-44929 | Critical | 9.8 | 2022-12-02 | An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles. |
CVE-2022-42718 | High | 7.8 | 2022-12-01 | Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable esca… |
CVE-2022-4020 | High | 8.1 | 2022-11-28 | Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot set… |
CVE-2022-41943 | Critical | 9.0 | 2022-11-22 | sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch`… |
CVE-2022-42130 | Medium | 4.3 | 2022-11-15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, a… |
CVE-2022-42128 | Medium | 5.3 | 2022-11-15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attack… |
CVE-2022-42127 | Medium | 5.3 | 2022-11-15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allo… |
CVE-2022-36377 | Medium | 6.7 | 2022-11-11 | Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Wi… |
CVE-2022-36367 | Medium | 4.4 | 2022-11-11 | Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informatio… |
CVE-2022-44561 | High | 7.5 | 2022-11-09 | The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability makes unauthorized apps add arbitrary wid… |
CVE-2022-44557 | High | 7.5 | 2022-11-09 | The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. Successful exploitation of this vul… |
CVE-2022-44554 | High | 7.5 | 2022-11-09 | The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the dev… |
CVE-2022-44548 | Medium | 4.3 | 2022-11-09 | There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may cause the dialog bo… |
CVE-2022-34824 | Critical | 9.8 | 2022-11-08 | Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Sing… |
CVE-2022-20465 | Medium | 4.6 | 2022-11-08 | In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code… |
CVE-2022-20452 | High | 7.8 | 2022-11-08 | In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escala… |
CVE-2022-20448 | Medium | 5.5 | 2022-11-08 | In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to l… |
CVE-2022-20441 | High | 7.8 | 2022-11-08 | In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalat… |
CVE-2022-43574 | High | 7.5 | 2022-11-03 | "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to applica… |
CVE-2020-36605 | Medium | 6.6 | 2022-11-01 | Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Li… |
CVE-2022-33182 | High | 7.8 | 2022-10-25 | A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated use… |
CVE-2020-5355 | Medium | 4.3 | 2022-10-21 | The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. This provides the re… |
CVE-2013-4281 | Medium | 5.5 | 2022-10-19 | In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with loca… |
CVE-2022-36439 | Medium | 6.0 | 2022-10-18 | AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and… |
CVE-2022-36438 | High | 7.8 | 2022-10-18 | AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also can be used to delete… |
CVE-2022-3368 | High | 7.3 | 2022-10-17 | A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate hi… |
CVE-2022-42464 | Medium | 6.7 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact… |
CVE-2022-36803 | High | 8.8 | 2022-10-14 | The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the Maste… |
CVE-2022-40187 | High | 8.0 | 2022-10-13 | Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces… |
CVE-2022-33922 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vu… |
CVE-2022-20436 | High | 7.8 | 2022-10-11 | There is an unauthorized service in the system service. Since the component does not have permission check, resulting in Local Elevation of privilege.Product… |
CVE-2022-20435 | High | 7.8 | 2022-10-11 | There is a Unauthorized service in the system service, may cause the system reboot. Since the component does not have permission check and permission protectio… |
CVE-2022-41748 | Medium | 6.7 | 2022-10-10 | A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials… |
CVE-2022-41414 | Medium | 5.3 | 2022-10-07 | An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and… |
CVE-2022-26235 | High | 7.8 | 2022-10-06 | A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advan… |
CVE-2022-3263 | High | 7.8 | 2022-09-23 | The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modi… |
CVE-2021-46834 | Medium | 5.5 | 2022-09-20 | A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected p… |
CVE-2022-38764 | High | 7.8 | 2022-09-19 | A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder o… |
CVE-2022-38466 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions… |
CVE-2022-2528 | Medium | 6.5 | 2022-09-09 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. |
CVE-2022-31251 | Medium | 6.5 | 2022-09-07 | A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm us… |
CVE-2022-2735 | High | 7.8 | 2022-09-06 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemo… |
CVE-2022-40109 | Critical | 9.8 | 2022-09-06 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions via binary /bin/boa. |
CVE-2022-36640 | Critical | 9.8 | 2022-09-02 | influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: th… |
CVE-2022-32743 | High | 7.5 | 2022-09-01 | Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. |
CVE-2022-37173 | High | 7.8 | 2022-08-30 | An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. |
CVE-2022-0336 | High | 8.8 | 2022-08-29 | The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database… |
CVE-2021-3917 | Medium | 5.5 | 2022-08-23 | A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a l… |
CVE-2021-3701 | Medium | 6.6 | 2022-08-23 | A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an att… |
CVE-2021-37289 | High | 7.2 | 2022-08-22 | Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.as… |
CVE-2022-27500 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information di… |
CVE-2022-26344 | High | 7.8 | 2022-08-18 | Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of… |
CVE-2022-25899 | Critical | 9.8 | 2022-08-18 | Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to poten… |
CVE-2021-44470 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentially enable informa… |
CVE-2021-39087 | Medium | 6.5 | 2022-08-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to… |
CVE-2021-30490 | High | 7.8 | 2022-08-16 | upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to… |
CVE-2022-20272 | Medium | 5.5 | 2022-08-12 | In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text. This could lead to loc… |
CVE-2022-20246 | High | 7.8 | 2022-08-11 | In WindowManager, there is a possible bypass of the restrictions for starting activities from the background due to an incorrect UID/permission check. This cou… |