Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
411 results · Clear filters · Feed
-
Medium 5.5CVE-2025-6264 Public exploit
Velociraptor priviledge escalation via UpdateConfig artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require h…
-
Medium 6.7
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect…
-
Medium 5.8
MaxKB Python Sandbox Bypass in Function Library
MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution …
-
Medium 5.5
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macO…
-
Medium 4.8
TCC Bypass via Dylib Substitution in DaVinci Resolve
Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altere…
-
Medium 4.0
Insecure file permissions can result in confidential information leakage
In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
-
Medium 4.8
TCC Bypass via Dylib Loading in Viscosity.app
On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. The acquired resource access is l…
-
Medium 5.0
Screen creates by default world-writable PTYs
The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system.
-
Medium 4.8
TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app
MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary comma…
-
Medium 6.7
Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to pot…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potential…
-
Medium 6.7
Incorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticate…
-
Medium 6.3
WatchGuard Terminal Services Agent Local Privilege Escalation via Non-Standard Installation Directory
The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
-
Medium 6.3
WatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation Directory
The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
-
Medium 5.9
Libcontainer is affected by capabilities elevation
libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all c…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sono…
-
Medium 5.5
Task Hijacking in hamza417/inure
A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive inf…
-
Medium 4.3
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) con…
-
Medium 6.2
Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may…
-
Medium 5.5
Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Lo…
-
Medium 6.7
Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authent…
-
Medium 6.7
Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authent…
-
Medium 4.4
The Snowflake Connector for Python uses insecure cache files permissions
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux …
-
Medium 5.0
Snowflake Connector for .NET has weak temporary files permissions
snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them …
-
Medium 4.4
Snowflake JDBC uses insecure temporary credential cache file permissions
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching…
-
Medium 5.4
RuoYi has insecure permissions
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
-
Medium 6.7
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy…
-
Medium 5.3
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. Files downloaded…
-
Medium 6.7
Weak default folder permissions
Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files
-
Medium 4.3
Cache confusion in Jenkins Eiffel Broadcaster Plugin
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to …
-
Medium 4.6
Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via …
-
Medium 5.1
Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execu…
-
Medium 5.3
MicroWorld eScan Antivirus Installation var default permission
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of the file /opt/MicroWorld/var/ of the component Installation Handler. The manipulation leads to inco…
-
Medium 5.5
libxl leaks data to PVH guests via ACPI tables
PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is…
-
Medium 6.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow…
-
Medium 4.2
Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user…
-
Medium 6.8CVE-2024-50657 Public exploit
An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCode…
-
Medium 5.3
Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from p…
-
Medium 5.3
Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive …
-
Medium 5.3
A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner…