CWE-276: Incorrect Default Permissions, page 13

During installation, installed file permissions are set to allow anyone to modify those files.

What the weakness is: CWE-276 at MITRE

1. 7.8CVE-2023-38295EPSS 0.2%2024-04-22

   Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permission that provides no protection at runtime. The missing permission is required as an access permissi…

2. 6.1CVE-2023-38294EPSS 0.2%2024-04-22

   Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220310_1027)') that allows local third-par…

3. 7.1CVE-2023-38291EPSS 0.2%2024-04-22

   An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. Various software builds for the following TCL devices (30Z and 10L) and Motorola devices (Moto G Pure…

4. 7.3CVE-2024-32368EPSS 0.3%2024-04-22

   Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a denial of service via the Bluetooth Low Energy (BLE) component.

5. 6.0CVE-2024-29967EPSS 0.2%2024-04-19

   In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo …

6. 5.5CVE-2024-29962EPSS 0.2%2024-04-19

   Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileges to access sensitive information or a Java binary.

7. 7.8CVE-2024-21116EPSS 0.4%2024-04-16

   Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infr…

8. 3.7CVE-2024-21012EPSS 0.9%2024-04-16

   Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracl…

9. 2.5CVE-2024-21004EPSS 0.4%2024-04-16

   Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. …

10. 2.5CVE-2024-21002EPSS 0.4%2024-04-16

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. …

11. 9.8CVE-2024-28056EPSS 1.7%2024-04-15

    Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Ef…

12. 5.1CVE-2024-21615EPSS 0.2%2024-04-12

    An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system. On all Junos OS and Junos OS Evolved platforms, whe…

13. 8.8CVE-2024-31442EPSS 0.5%2024-04-08

    Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/crea…

14. 7.8CVE-2024-26574EPSS 0.3%2024-04-08

    Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script to the WSNativePushService.exe

15. 7.5CVE-2023-52545EPSS 0.4%2024-04-08

    Vulnerability of undefined permissions in the Calendar app. Impact: Successful exploitation of this vulnerability will affect availability.

16. 5.3CVE-2023-52717EPSS 0.3%2024-04-07

    Permission verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability.

17. 9.1CVE-2024-30415EPSS 0.4%2024-04-07

    Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.

18. 7.8CVE-2024-30977EPSS 0.2%2024-04-05

    An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the password component.

19. 7.8CVE-2024-27674EPSS 0.3%2024-04-03

    Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary.

20. 7.3CVE-2024-0259EPSS 0.3%2024-03-28

    Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with loc…

21. 7.8CVE-2024-25958EPSS 0.1%2024-03-26

    Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to privilege escalation, unauthorize…

22. 2.8CVE-2024-30204EPSS 0.5%2024-03-25

    In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

23. 6.2CVE-2024-22085EPSS 0.2%2024-03-20

    An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.

24. 5.5CVE-2024-25654EPSS 0.2%2024-03-18

    Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensit…

25. 7.8CVE-2024-1605EPSS 0.2%2024-03-18

    BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, whi…

26. 5.5CVE-2024-28862EPSS 0.2%2024-03-16

    The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch m…

27. 6.7CVE-2023-28389EPSS 0.1%2024-03-14

    Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

28. 5.5CVE-2024-20671EPSS 0.9%2024-03-12

    Microsoft Defender Security Feature Bypass Vulnerability

29. 5.5CVE-2024-23295EPSS 0.3%2024-03-08

    A permissions issue was addressed to help ensure Personas are always protected. This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona.

30. 3.3CVE-2024-23253EPSS 0.4%2024-03-08

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to access a user's Photos Library.

31. 5.5CVE-2024-23201EPSS 0.2%2024-03-08

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An app may be able to cause a denial-…

32. 7.5CVE-2024-22889EPSS 0.7%2024-03-06

    Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

33. 5.5CVE-2024-20841EPSS 0.2%2024-03-05

    Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data.

34. 5.3CVE-2024-20830EPSS 0.1%2024-03-05

    Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings.

35. 8.2CVE-2024-20005EPSS 0.10%2024-03-04

    In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS083555…

36. 4.7CVE-2024-26280EPSS 1.9%2024-03-01

    Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops …

37. 7.5CVE-2023-49338EPSS 0.6%2024-02-28

    Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.

38. 4.8CVE-2024-26302EPSS 0.4%2024-02-27

    A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve informat…

39. 5.5CVE-2023-48678EPSS 0.2%2024-02-27

    Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.

40. 8.4CVE-2023-50975EPSS 0.2%2024-02-21

    The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a …

41. 8.4CVE-2023-7235EPSS 0.2%2024-02-21

    The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries t…

42. 5.5CVE-2023-42953EPSS 0.2%2024-02-21

    A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.

43. 5.5CVE-2023-42945EPSS 0.3%2024-02-21

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth.

44. 7.8CVE-2023-42928EPSS 0.2%2024-02-21

    The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated privileges.

45. 7.8CVE-2024-1156EPSS 0.4%2024-02-20

    Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.

46. 7.8CVE-2024-1155EPSS 0.3%2024-02-20

    Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.

47. 5.3CVE-2024-25605EPSS 0.5%2024-02-20

    The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web…

48. 7.5CVE-2023-52379EPSS 0.3%2024-02-18

    Permission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiality.

49. 7.5CVE-2023-52362EPSS 0.4%2024-02-18

    Permission management vulnerability in the lock screen module.Successful exploitation of this vulnerability may affect availability.

50. 5.9CVE-2024-20921EPSS 0.9%2024-02-17

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21…