Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
467 results · Clear filters · Feed
-
High 7.8
In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" …
-
High 7.8CVE-2022-20474 Public exploit
In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a co…
-
High 8.8
RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 …
-
High 8.8
Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system …
-
High 7.8
Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authe…
-
High 8.1
Acer Aspire BIOS vulnerability
Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable.
-
High 8.4
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation …
-
High 7.8
A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of pr…
-
High 7.5
The preset launcher module has a permission verification vulnerability. Successful exploitation of this vulnerability m…
-
High 7.5
The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may caus…
-
High 7.5
The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system fi…
-
High 7.8
In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in th…
-
High 7.8CVE-2022-20452 Public exploit
In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused…
-
High 7.5
"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assign…
-
High 7.8
A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn…
-
High 7.8
AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege esca…
-
High 7.3CVE-2022-3368 Public exploit
Software Updater of Avira Security for Windows vulnerable to Privilege Escalation
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
-
High 8.8
The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the…
-
High 8.0
Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service …
-
High 7.0
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege at…
-
High 7.8
Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated u…
-
High 7.8
e-Design - Multiple vulnerabilities
Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine.
-
High 8.8
Incorrect Default Permissions in Cilium
Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16, 1.10.11, and 1.11.15 contains an incorrect default permissions vulnerability. Operating Systems wi…
-
High 7.5
Podman's default inheritable capabilities for linux container not empty
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This …
-
High 7.8
Delta Electronics DIAEnergie Incorrect Default Permissions
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files.
-
High 7.1
Incorrect Default Permissions in Cobbler
An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains th…
-
High 7.8
Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to p…
-
High 7.8
Incorrect default permissions in the software installer for the Intel(R) Advisor before version 2021.4.0 may allow an a…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-craft…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-cr…
-
High 8.8
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-c…
-
High 8.8
A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be repla…
-
High 8.8
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-S…
-
High 8.8
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-S…
-
High 8.8
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-S…
-
High 8.8
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.…
-
High 7.8
Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe
Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This iss…
-
High 8.8
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrit…
-
High 8.8
The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for …
-
High 7.8
virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group
A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root. This issue affects: openSUSE Factory virtualbox version 6.1.20-1.1 and prior versions.