CWE-276: Incorrect Default Permissions, page 14
Filter
During installation, installed file permissions are set to allow anyone to modify those files.
What the weakness is: CWE-276 at MITRE
Ask an AI about CWE-276
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-276: Incorrect Default Permissions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/276.html and https://cve.bz/cve/cwe/276?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2024-0034EPSS 0.1%
In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…
- 7.3CVE-2024-1488EPSS 0.3%
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the c…
- 6.7CVE-2023-49721EPSS 0.2%
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
- 7.8CVE-2023-41231EPSS 0.2%
Incorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8CVE-2023-40154EPSS 0.2%
Incorrect default permissions in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow privillaged user to potentially enable escalation of privilege via local access.
- 7.8CVE-2023-34315EPSS 0.2%
Incorrect default permissions in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 6.0CVE-2023-29162EPSS 0.2%
Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access.
- 7.8CVE-2023-28739EPSS 0.2%
Incorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.3CVE-2023-38960EPSS 0.3%
Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.
- 7.8CVE-2023-50236EPSS 0.1%
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerabili…
- 7.8CVE-2024-24828EPSS 0.2%
pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix systems, this is `/tmp/pkg/*` which is a shared directory for all users on the same lo…
- 5.5CVE-2024-22430EPSS 0.1%
Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicious user could potentially exploit this vulnerability, leading to denial of service.
- 7.8CVE-2024-0833EPSS 0.2%
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower …
- 7.1CVE-2024-21840EPSS 0.1%
Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.0.0 through 04.9.2.
- 5.5CVE-2023-29081EPSS 0.1%
A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users to cause a Denial of Service (DoS) condition when handling move operations on lo…
- 7.5CVE-2024-22301EPSS 0.4%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
- 5.5CVE-2022-4964EPSS 0.3%
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
- 7.1CVE-2024-0770EPSS 0.3%
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incor…
- 7.8CVE-2023-29244EPSS 0.1%
Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before version 5.4.1.4479 may allow an authenticated user to potentially enable escalation …
- 8.8CVE-2024-22409EPSS 0.7%
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low priv…
- 7.8CVE-2024-22428EPSS 0.2%
Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escalate privileges and execute arbitrary code on the affected system. Dell recommends…
- 7.1CVE-2023-6457EPSS 0.1%
Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write specific files.This issue affects Hitachi Tuning Manager: before 8.8.5-04.
- 5.5CVE-2024-23301EPSS 0.3%
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.
- 7.8CVE-2022-45793EPSS 0.3%
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
- 7.8CVE-2023-50612EPSS 0.3%
Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.
- 6.4CVE-2023-5536EPSS 0.2%
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password.
- 8.8CVE-2021-3187EPSS 0.6%
An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges by running a malicious script (that executes as root from a temporary directory) during install time…
- 6.5CVE-2023-28870EPSS 0.7%
Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.
- 5.3CVE-2023-6273EPSS 0.4%
Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abnormally.
- 9.8CVE-2023-46773EPSS 0.5%
Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5CVE-2023-37572EPSS 0.6%
Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery service. The service executable could be changed or the service could be deleted.
- 5.5CVE-2023-40076EPSS 2.3%
In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed…
- 9.8CVE-2023-21216EPSS 0.4%
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User …
- 9.8CVE-2023-47462EPSS 1.3%
Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function.
- 4.3CVE-2023-42501EPSS 0.9%
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `…
- 7.2CVE-2023-6302EPSS 0.9%
A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The at…
- 8.8CVE-2023-47250EPSS 1.4%
In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DI…
- 3.3CVE-2023-43081EPSS 0.2%
PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. A low Privileged local attacker could potentially exploit this vulnerability, leading to overwriting …
- 5.5CVE-2023-42774EPSS 0.2%
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.
- 7.1CVE-2023-3116EPSS 0.2%
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions.
- 6.5CVE-2023-40363EPSS 0.6%
IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force ID: 263332.
- 9.8CVE-2023-48648EPSS 1.2%
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folder…
- 6.5CVE-2023-47335EPSS 0.3%
Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones.
- 7.8CVE-2023-41718EPSS 0.5%
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file.
- 7.8CVE-2023-35080EPSS 0.7%
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalati…
- 7.8CVE-2023-32638EPSS 0.2%
Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8CVE-2023-27305EPSS 0.2%
Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8CVE-2023-23583EPSS 1.3%
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local acc…
- 4.3CVE-2023-46743EPSS 0.5%
application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit m…
- 7.8CVE-2023-4706EPSS 0.2%
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.