CWE-276
Incorrect Default Permissions
Description
During installation, installed file permissions are set to allow anyone to modify those files.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-1 · CAPEC-127 · CAPEC-81
CVEs mapped to this weakness (1,581)
page 11 of 80| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2014-2721 | Hig | 0.57 | 8.8 | 0.02 | Mar 19, 2020 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an… | ||
| CVE-2020-9408 | Hig | 0.57 | 8.8 | 0.01 | Mar 11, 2020 | The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group… | ||
| CVE-2019-19475 | Hig | 0.57 | 8.8 | 0.03 | Jan 10, 2020 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can… | ||
| CVE-2012-4434 | Hig | 0.57 | 8.8 | 0.03 | Jan 9, 2020 | fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. | ||
| CVE-2019-19202 | Hig | 0.57 | 8.8 | 0.01 | Nov 21, 2019 | In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request. | ||
| CVE-2015-9477 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2019 | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. | ||
| CVE-2015-9476 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2019 | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. | ||
| CVE-2015-9475 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2019 | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. | ||
| CVE-2015-9474 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2019 | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. | ||
| CVE-2019-17383 | Cri | 0.57 | 9.8 | 0.02 | Oct 9, 2019 | The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. | ||
| CVE-2019-9679 | Hig | 0.57 | 8.8 | 0.01 | Sep 18, 2019 | Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for… | ||
| CVE-2019-12450 | Cri | 0.57 | 9.8 | 0.03 | May 29, 2019 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. | ||
| CVE-2018-10605 | Hig | 0.57 | 8.8 | 0.01 | Oct 1, 2018 | Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over the RTU using default credentials to connect to the RTU. | ||
| CVE-2018-10604 | Hig | 0.57 | 8.8 | 0.02 | Jul 24, 2018 | SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution. | ||
| CVE-2017-16522 | Hig | 0.57 | 8.8 | 0.03 | Nov 3, 2017 | MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute. | ||
| CVE-2017-12230 | Hig | 0.57 | 8.8 | 0.03 | Sep 29, 2017 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using… | ||
| CVE-2025-44643 | Hig | 0.56 | 8.6 | 0.00 | Aug 4, 2025 | Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with… | ||
| CVE-2023-2749 | Hig | 0.56 | 8.6 | 0.00 | May 31, 2023 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be… | ||
| CVE-2013-4859 | Hig | 0.56 | 8.1 | 0.07 | Dec 27, 2019 | INSTEON Hub 2242-222 lacks Web and API authentication | ||
| CVE-2018-11454 | Hig | 0.56 | 8.6 | 0.00 | Aug 7, 2018 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions… |
- risk 0.57cvss 8.8epss 0.02
In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The vulnerability is caused by a configuration error, and is not the result of an…
- risk 0.57cvss 8.8epss 0.01
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group…
- risk 0.57cvss 8.8epss 0.03
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can…
- risk 0.57cvss 8.8epss 0.03
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.
- risk 0.57cvss 8.8epss 0.01
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
- risk 0.57cvss 8.8epss 0.01
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
- risk 0.57cvss 8.8epss 0.01
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
- risk 0.57cvss 8.8epss 0.01
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
- risk 0.57cvss 8.8epss 0.01
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
- risk 0.57cvss 9.8epss 0.02
The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
- risk 0.57cvss 8.8epss 0.01
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for…
- risk 0.57cvss 9.8epss 0.03
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
- risk 0.57cvss 8.8epss 0.01
Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over the RTU using default credentials to connect to the RTU.
- risk 0.57cvss 8.8epss 0.02
SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
- risk 0.57cvss 8.8epss 0.03
MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute.
- risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using…
- risk 0.56cvss 8.6epss 0.00
Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with…
- risk 0.56cvss 8.6epss 0.00
Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be…
- risk 0.56cvss 8.1epss 0.07
INSTEON Hub 2242-222 lacks Web and API authentication
- risk 0.56cvss 8.6epss 0.00
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions…