Weakness (CWE)
CWE-275: Permission Issues
Weaknesses in this category are related to improper assignment or handling of permissions.
Source: MITRE CWE-275
57 results · Feed
-
High 7.7
Insecure file and directory permissions on EdgeRover
File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once a…
-
High 7.5
Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability
A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. This vulnerability is due to an unrestricted Trivial …
-
Unscored —
Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring file…
-
Medium 6.7
Cisco Connected Mobile Experiences Privilege Escalation Vulnerability
A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary commands with root privileges. The vulnerability is due to improper user permissions that are configu…
-
Medium 5.0
Location service uses cached authorization even after revocation
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by…
-
High 7.8
ABB Central Licensing System - Weak File Permissions
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2…
-
High 7.8
ABB System 800xA Weak Registry Permissions
Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, allowing an authenticated attacker to cause system functions to stop or malfunction.
-
Medium 4.4
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An atta…
-
Medium 4.1
Cisco RoomOS Software Privilege Escalation Vulnerability
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could e…
-
High 7.8
Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Tetration Analytics Agent Arbitrary Code Execution Vulnerability
A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to an incorrect permissions setting. An att…
-
Medium 5.1
Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability
A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerab…
-
Unscored —
Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability
A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the …
-
Unscored —
A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by …
-
Unscored —
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permiss…
-
Unscored —
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permi…
-
Unscored —
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restor…
-
Unscored —
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebD…