CWE-276: Incorrect Default Permissions, page 25

During installation, installed file permissions are set to allow anyone to modify those files.

What the weakness is: CWE-276 at MITRE

1. 6.7CVE-2020-8701EPSS 0.3%2021-02-17

   Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.

2. 5.5CVE-2020-0524EPSS 0.2%2021-02-17

   Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access.

3. 5.3CVE-2021-20653EPSS 1.2%2021-02-17

   Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without ac…

4. 7.8CVE-2020-28392EPSS 0.3%2021-02-09

   A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are configured for the application folder and subfolders which could allow an attacke…

5. 5.7CVE-2020-16144EPSS 0.8%2021-02-09

   When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to dele…

6. 7.8CVE-2020-25245EPSS 0.3%2021-02-09

   A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code…

7. 8.8CVE-2021-3394ExploitEPSS 5.8%2021-02-09

   Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation.

8. 4.3CVE-2021-21436EPSS 0.8%2021-02-08

   Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions.

9. 5.3CVE-2020-29582EPSS 2.6%2021-02-03

   In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

10. 5.3CVE-2020-25208EPSS 1.4%2021-02-03

    In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

11. 9.8CVE-2019-20468EPSS 2.3%2021-02-01

    An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS.

12. 5.5CVE-2020-26941EPSS 0.3%2021-01-26

    A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlink, due to insecure permissions. The possibility of exploiting this vulnerability…

13. 4.3CVE-2020-11997EPSS 1.3%2021-01-19

    Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed th…

14. 6.5CVE-2020-13922EPSS 1.8%2021-01-11

    Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

15. 7.1CVE-2021-1056EPSS 1.7%2021-01-08

    NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which ma…

16. 9.8CVE-2020-13452EPSS 2.9%2021-01-07

    In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution.

17. 6.7CVE-2020-29489EPSS 0.2%2021-01-05

    Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system f…

18. 8.8CVE-2020-13541EPSS 0.6%2021-01-05

    An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite the service executable and execute arbi…

19. 7.8CVE-2020-13540EPSS 0.5%2021-01-05

    An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite…

20. 7.8CVE-2020-13539EPSS 0.6%2021-01-05

    An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911 Mobile Runtime” service. Depending on the vector chosen, an attacker can overwri…

21. 10.0CVE-2020-29492EPSS 1.7%2021-01-04

    Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of…

22. 8.6CVE-2020-29491EPSS 1.8%2021-01-04

    Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local networ…

23. 4.3CVE-2020-26031EPSS 0.6%2020-12-28

    An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base readers (who are authenticated but have insufficient permissions).

24. 7.8CVE-2020-13535EPSS 0.7%2020-12-18

    A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges.

25. 7.8CVE-2020-0486EPSS 0.1%2020-12-15

    In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges nee…

26. 7.8CVE-2020-5798EPSS 0.3%2020-12-07

    inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions.

27. 7.8CVE-2020-13542EPSS 0.6%2020-12-03

    A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service,…

28. 7.8CVE-2020-8539ExploitEPSS 2.3%2020-12-01

    Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities.…

29. 3.3CVE-2020-11867EPSS 0.5%2020-11-30

    Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files loca…

30. 7.3CVE-2020-12510EPSS 0.9%2020-11-19

    The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the c…

31. 6.5CVE-2020-13351EPSS 1.4%2020-11-17

    Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0…

32. 5.5CVE-2020-24460EPSS 0.2%2020-11-12

    Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local access.

33. 7.8CVE-2020-24456EPSS 0.3%2020-11-12

    Incorrect default permissions in the Intel(R) Board ID Tool version v.1.01 may allow an authenticated user to potentially enable escalation of privilege via local access.

34. 7.8CVE-2020-12346EPSS 0.3%2020-11-12

    Improper permissions in the installer for the Intel(R) Battery Life Diagnostic Tool before version 1.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.

35. 7.8CVE-2020-13770EPSS 0.5%2020-11-12

    Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges…

36. 7.8CVE-2020-12354EPSS 0.3%2020-11-12

    Incorrect default permissions in Windows(R) installer in Intel(R) AMT SDK versions before 14.0.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

37. 7.8CVE-2020-12307EPSS 0.3%2020-11-12

    Improper permissions in some Intel(R) High Definition Audio drivers before version 9.21.00.4561 may allow an authenticated user to potentially enable escalation of privilege via local access.

38. 7.8CVE-2020-12306EPSS 0.3%2020-11-12

    Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potentially enable escalation of privilege via local access.

39. 5.3CVE-2020-26809EPSS 2.1%2020-11-10

    SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive file…

40. 3.3CVE-2020-26807EPSS 0.3%2020-11-10

    SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone to modify the files in the folder.

41. 4.9CVE-2020-24402EPSS 1.7%2020-11-09

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to …

42. 7.8CVE-2020-13537EPSS 0.5%2020-11-05

    An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By defau…

43. 7.8CVE-2020-13536EPSS 0.5%2020-11-05

    An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By defa…

44. 6.8CVE-2020-28044EPSS 0.3%2020-11-02

    An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and then list, read, create, and overwrite files with MAINAPP permissions.

45. 6.5CVE-2020-28041EPSS 2.0%2020-11-02

    The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site …

46. 4.3CVE-2020-27358EPSS 2.0%2020-11-02

    An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changin…

47. 2.4CVE-2019-8777EPSS 0.3%2020-10-27

    A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra.…

48. 6.7CVE-2019-14718EPSS 1.2%2020-10-23

    Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privilege escalation.

49. 7.5CVE-2020-27665EPSS 1.2%2020-10-22

    In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.

50. 7.3CVE-2020-17381EPSS 0.4%2020-10-21

    An issue was discovered in Ghisler Total Commander 9.51. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the %SYSTEMDRIVE%\totalcmd\TOTALCMD64.EXE binary.