cve.bz

CWE-276: Incorrect Default Permissions, page 10

Filter

During installation, installed file permissions are set to allow anyone to modify those files.

What the weakness is: CWE-276 at MITRE

Ask an AI about CWE-276

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-276: Incorrect Default Permissions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/276.html and https://cve.bz/cve/cwe/276?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2024-46463EPSS 0.2%

    By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ORIZON has to be modified to prevent this vulner…

  2. 7.8CVE-2024-46462EPSS 0.2%

    By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZEDMAIL has to be modified to prevent this vuln…

  3. 4.6CVE-2024-42188EPSS 0.2%

    HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.

  4. 8.0CVE-2024-52551EPSS 0.6%

    Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to res…

  5. 5.4CVE-2024-35201EPSS 0.1%

    Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via local access.

  6. 5.4CVE-2024-29083EPSS 0.2%

    Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

  7. 5.4CVE-2024-25647EPSS 0.1%

    Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 8.5CVE-2024-21820EPSS 0.2%

    Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.

  9. 7.8CVE-2024-43089EPSS 0.10%

    In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…

  10. 5.5CVE-2024-43086EPSS 0.09%

    In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to local information disclosure with no additional execution priv…

  11. 7.8CVE-2024-43085EPSS 0.1%

    In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in the code. This could lead to local escalation of privilege with no additional exe…

  12. 7.8CVE-2024-43081EPSS 0.1%

    In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.…

  13. 7.8CVE-2024-40661EPSS 0.10%

    In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privilege…

  14. 7.8CVE-2024-40660EPSS 0.1%

    In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.…

  15. 7.0CVE-2024-49504EPSS 0.3%

    grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.

  16. 7.3CVE-2024-21958EPSS 0.3%

    Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

  17. 7.3CVE-2024-21957EPSS 0.3%

    Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  18. 7.3CVE-2024-21946EPSS 0.2%

    Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  19. 7.3CVE-2024-21945EPSS 0.2%

    Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  20. 7.3CVE-2024-21939EPSS 0.2%

    Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  21. 7.8CVE-2024-21938EPSS 0.2%

    Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary cod…

  22. 7.8CVE-2024-21937EPSS 0.3%

    Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  23. 5.3CVE-2024-46894EPSS 0.3%

    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a user to query the "/api/sftp/users" endpoint. This could allow an authenticated rem…

  24. 4.3CVE-2024-47593EPSS 0.4%

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server i…

  25. 5.3CVE-2024-43430EPSS 0.3%

    A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

  26. 7.8CVE-2024-50590EPSS 0.2%

    Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory o…

  27. 9.8CVE-2023-27195EPSS 1.0%

    Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tm_ajax.msw reques…

  28. 7.5CVE-2024-36063EPSS 0.3%

    The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activit…

  29. 8.8CVE-2020-11921EPSS 0.2%

    An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection between the Lush 2 and a mobile phone. This allows an attacker to gain full con…

  30. 8.8CVE-2019-20458EPSS 0.4%

    An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no point prompted to set up a password on the device (leaving a number of devices …

  31. 9.1CVE-2019-20457EPSS 0.7%

    An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because the response header of any failed login attempt returns an incomplete authorizati…

  32. 7.1CVE-2024-34679EPSS 0.1%

    Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.

  33. 7.8CVE-2024-9191EPSS 0.2%

    The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless log…

  34. 5.3CVE-2024-48572EPSS 0.4%

    A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed a…

  35. 7.5CVE-2024-44228EPSS 0.4%

    This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.

  36. 3.3CVE-2024-40792EPSS 0.2%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A malicious app may be able to change network settings.

  37. 8.8CVE-2024-42028EPSS 0.2%

    A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege acti…

  38. 6.5CVE-2024-10469EPSS 0.2%

    VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.

  39. 9.8CVE-2022-30355EPSS 0.5%

    OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.

  40. 7.8CVE-2024-47016EPSS 0.07%

    there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  41. 8.8CVE-2024-47014EPSS 0.2%

    Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.

  42. 7.8CVE-2024-47013EPSS 0.07%

    In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need…

  43. 7.8CVE-2024-47012EPSS 0.08%

    In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…

  44. 7.5CVE-2024-44100EPSS 0.3%

    Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545.

  45. 9.8CVE-2024-9947EPSS 0.5%

    The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login token. This makes it pos…

  46. 7.8CVE-2024-7587EPSS 0.2%

    Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prio…

  47. 5.2CVE-2024-10183EPSS 0.1%

    A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems.

  48. 6.7CVE-2024-35287EPSS 0.2%

    A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution …

  49. 8.7CVE-2024-47825EPSS 0.4%

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if th…

  50. 6.3CVE-2024-47240EPSS 0.2%

    Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system and could potentially exploit this vulnerability to gain write access to unauth…