CWE-275: Permission Issues, page 3

Weaknesses in this category are related to improper assignment or handling of permissions.

What the weakness is: CWE-275 at MITRE

1. 4.3CVE-2016-9462EPSS 1.9%2017-03-28

   Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a…

2. 4.3CVE-2016-9461EPSS 2.0%2017-03-28

   Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an a…

3. 4.3CVE-2016-2406EPSS 0.6%2017-03-20

   The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissio…

4. 9.9CVE-2017-6513EPSS 1.3%2017-03-11

   The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL.

5. 3.3CVE-2016-7553EPSS 0.4%2017-02-27

   The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local users to obtain sensitive information from private chat conversations by reading th…

6. 4.4CVE-2016-6648EPSS 0.4%2017-02-03

   EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissions set on a sensitive system file. A ma…

7. 6.5CVE-2016-3022EPSS 1.7%2017-02-01

   IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.

8. 3.3CVE-2016-0394EPSS 0.3%2017-02-01

   IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.

9. 6.7CVE-2016-8214EPSS 0.4%2017-01-25

   EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3.0 and 7.3.1 contain a vulnerability that may allow malicious administrators to compromise Avamar servers.

10. 5.3CVE-2016-8605EPSS 2.8%2017-01-12

    The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the o…

11. 5.5CVE-2016-9869EPSS 0.3%2017-01-06

    An issue was discovered in EMC ScaleIO versions before 2.0.1.1. Incorrect permissions on the SCINI driver may allow a low-privileged local attacker to modify the configuration and render the ScaleIO Data Client (SDC) server unavailable.

12. 8.4CVE-2016-4288EPSS 0.6%2017-01-06

    A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to execute arbitrary programs with SYSTEM privileges.

13. 3.3CVE-2016-2877EPSS 0.3%2016-11-30

    IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to modify data by writing to a file.

14. 5.5CVE-2016-6719EPSS 0.3%2016-11-25

    An elevation of privilege vulnerability in the Bluetooth component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to pair wit…

15. 5.5CVE-2016-6715EPSS 0.3%2016-11-25

    An elevation of privilege vulnerability in the Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could allow a local malicious application to record audio w…

16. 7.8CVE-2016-7382EPSS 0.4%2016-11-08

    For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) handler where a missing permissions check may allow user…

17. 7.8CVE-2016-8856EPSS 0.8%2016-10-31

    Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file permissions could be exploited by attackers to execute arbitrary code. After the installation, Foxi…

18. 7.5CVE-2016-7988EPSS 0.6%2016-10-31

    On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-ser…