Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
81 results · Clear filters · Feed
-
Critical 9.1
YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorizati…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
Critical 9.8
Memu Play 7.1.3 - Insecure Folder Permissions
Memu Play 7.1.3 contains an insecure folder permissions vulnerability that allows low-privileged users to modify the MemuService.exe executable. Attackers can replace the service executable with a malicious file during system restart to gain SYSTEM-level priv…
-
Critical 9.8
An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a m…
-
Critical 9.8
Apache DolphinScheduler Incorrect Default Permissions Vulnerability
Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.
-
Critical 9.8
Incorrect URL stripping in CSP reports
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13…
-
Critical 9.8
pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered th…
-
Critical 9.8
ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits
Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHan…
-
Critical 9.9
A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contai…
-
Critical 9.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, …
-
Critical 9.8
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sono…
-
Critical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…
-
Critical 9.8
A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, m…
-
Critical 9.8
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macO…
-
Critical 9.8
HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafte…
-
Critical 9.8
PipeCD Vulnerable to Privilege Escalation
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Pe…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links…
-
Critical 9.8
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Jour…
-
Critical 9.8
MaysWind ezBookkeeping has Improper Privilege Management
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.
-
Critical 9.8CVE-2024-55215 Public exploit
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization inte…
-
Critical 9.7
Dumb Drop has an arbitrary file overwrite and path traversal for root shell
Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritt…
-
Critical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…
-
Critical 9.1
CMSimple 5.16 allows the user to edit log.php file via print page.
-
Critical 9.1
Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
-
Critical 9.8CVE-2024-57684 EPSS 15%
An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated a…
-
Critical 9.8
Vaultwarden vulnerable to user impersonation
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
-
Critical 9.1
Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.
-
Critical 9.8
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server b…
-
Critical 9.8
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an…
-
Critical 9.8
COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows a…
-
Critical 9.8
WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows…
-
Critical 9.8
WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attack…
-
Critical 9.8
OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, al…
-
Critical 9.8
In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could l…
-
Critical 9.8
AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.
-
Critical 9.8
Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve t…
-
Critical 9.1
An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be ret…