cve.bz

CWE-276: Incorrect Default Permissions, page 21

Filter

During installation, installed file permissions are set to allow anyone to modify those files.

What the weakness is: CWE-276 at MITRE

Ask an AI about CWE-276

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-276: Incorrect Default Permissions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/276.html and https://cve.bz/cve/cwe/276?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2021-1033EPSS 0.1%

    In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interactio…

  2. 7.8CVE-2021-1000EPSS 0.1%

    In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. Use…

  3. 6.5CVE-2022-22948KEVExploitEPSS 13%

    The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

  4. 7.8CVE-2022-26839EPSS 0.2%

    Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable fi…

  5. 8.8CVE-2021-40904EPSS 3.7%

    The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which allows embedded php code. As a result, remote code execution is achieved. Successfu…

  6. 8.2CVE-2021-44905EPSS 1.3%

    Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.

  7. 9.8CVE-2022-27919EPSS 1.8%

    Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.

  8. 5.3CVE-2021-44751EPSS 0.6%

    A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to sen…

  9. 6.5CVE-2022-25570EPSS 0.8%

    In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one…

  10. 5.5CVE-2021-22571EPSS 0.2%

    A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above.

  11. 8.1CVE-2022-25364EPSS 1.0%

    In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it w…

  12. 7.8CVE-2021-39694EPSS 0.1%

    In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges ne…

  13. 7.8CVE-2022-25815EPSS 0.1%

    PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.

  14. 7.8CVE-2022-25814EPSS 0.1%

    PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.

  15. 5.5CVE-2021-44216EPSS 0.4%

    Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.

  16. 5.5CVE-2021-44215EPSS 0.4%

    Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

  17. 6.5CVE-2021-40059EPSS 0.3%

    There is a permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect confidentiality.

  18. 9.1CVE-2021-40053EPSS 0.7%

    There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.

  19. 7.5CVE-2021-40049EPSS 0.8%

    There is a permission control vulnerability in the PMS module. Successful exploitation of this vulnerability can lead to sensitive system information being obtained without authorization.

  20. 3.3CVE-2021-3981EPSS 0.3%

    A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those use…

  21. 4.3CVE-2021-32006EPSS 0.6%

    This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup fi…

  22. 5.5CVE-2021-20269EPSS 0.3%

    A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability i…

  23. 7.8CVE-2022-25943EPSS 0.7%

    The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.

  24. 6.5CVE-2021-38268EPSS 0.8%

    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members,…

  25. 7.5CVE-2021-41652EPSS 1.1%

    Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.

  26. 5.5CVE-2021-37103EPSS 0.2%

    There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality.

  27. 4.3CVE-2022-24343EPSS 0.6%

    In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.

  28. 6.5CVE-2022-24337EPSS 0.7%

    In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.

  29. 5.5CVE-2022-25327EPSS 0.1%

    The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt met…

  30. 7.8CVE-2022-23922EPSS 0.2%

    WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed.

  31. 7.8CVE-2022-23104EPSS 0.2%

    WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could wr…

  32. 7.1CVE-2021-45083EPSS 0.3%

    An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.dig…

  33. 6.3CVE-2021-3948EPSS 0.6%

    An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integ…

  34. 5.5CVE-2021-3155EPSS 0.3%

    snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.…

  35. 9.8CVE-2021-20001EPSS 1.6%

    It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which could result in privilege escalation.

  36. 3.3CVE-2022-23996EPSS 0.4%

    Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.

  37. 3.3CVE-2022-23995EPSS 0.4%

    Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.

  38. 9.8CVE-2021-39658EPSS 0.6%

    ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrar…

  39. 9.1CVE-2021-39635EPSS 0.5%

    ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product:…

  40. 9.8CVE-2020-14521EPSS 1.3%

    Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of…

  41. 7.8CVE-2022-21204EPSS 0.2%

    Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  42. 5.5CVE-2021-33166EPSS 0.2%

    Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated user to potentially enable information disclosure via local access.

  43. 7.8CVE-2021-33129EPSS 0.2%

    Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  44. 7.8CVE-2021-22817EPSS 0.2%

    A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo…

  45. 4.4CVE-2021-0093EPSS 0.2%

    Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.

  46. 7.8CVE-2022-24113EPSS 0.2%

    Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Prot…

  47. 6.5CVE-2022-24301EPSS 1.0%

    In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.

  48. 9.8CVE-2021-46093EPSS 1.2%

    eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.

  49. 8.8CVE-2021-40416EPSS 0.9%

    An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. All the Get APIs that are not included in cgi_check_ability are already executable by any lo…

  50. 6.5CVE-2021-40415EPSS 0.8%

    An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. In cgi_check_ability the Format API does not have a specific case, the user permission will …