CWE-276
Incorrect Default Permissions
Description
During installation, installed file permissions are set to allow anyone to modify those files.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-1 · CAPEC-127 · CAPEC-81
CVEs mapped to this weakness (474)
page 24 of 24| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17383 | — | 0.00 | — | 0.02 | Oct 9, 2019 | The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. | ||
| CVE-2019-16355 | — | 0.00 | — | 0.00 | Sep 16, 2019 | The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. | ||
| CVE-2014-8327 | 0.00 | — | 0.01 | Oct 27, 2014 | The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors. | |||
| CVE-2013-4394 | 0.00 | — | 0.00 | Oct 28, 2013 | The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain… | |||
| CVE-2013-0248 | 0.00 | — | 0.01 | Mar 15, 2013 | The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. | |||
| CVE-2012-4453 | 0.00 | — | 0.00 | Oct 9, 2012 | dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information. | |||
| CVE-2011-4285 | 0.00 | — | 0.02 | Jul 16, 2012 | The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role. | |||
| CVE-2011-4361 | 0.00 | — | 0.03 | Jan 8, 2012 | MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated… | |||
| CVE-2011-2859 | 0.00 | — | 0.01 | Sep 19, 2011 | Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors. | |||
| CVE-2011-2782 | 0.00 | — | 0.01 | Aug 3, 2011 | The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors. | |||
| CVE-2011-1435 | 0.00 | — | 0.01 | May 3, 2011 | Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafted extension. | |||
| CVE-2010-4176 | 0.00 | — | 0.02 | Dec 7, 2010 | plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users. | |||
| CVE-2004-1778 | 0.00 | — | 0.00 | Dec 22, 2004 | Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows local users to modify language files and possibly conduct social engineering or other attacks. | |||
| CVE-2002-0493 | 0.00 | — | 0.04 | Aug 12, 2002 | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions. |
- CVE-2019-17383Oct 9, 2019risk 0.00cvss —epss 0.02
The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
- CVE-2019-16355Sep 16, 2019risk 0.00cvss —epss 0.00
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
- CVE-2014-8327Oct 27, 2014risk 0.00cvss —epss 0.01
The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
- CVE-2013-4394Oct 28, 2013risk 0.00cvss —epss 0.00
The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain…
- CVE-2013-0248Mar 15, 2013risk 0.00cvss —epss 0.01
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
- CVE-2012-4453Oct 9, 2012risk 0.00cvss —epss 0.00
dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
- CVE-2011-4285Jul 16, 2012risk 0.00cvss —epss 0.02
The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role.
- CVE-2011-4361Jan 8, 2012risk 0.00cvss —epss 0.03
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated…
- CVE-2011-2859Sep 19, 2011risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors.
- CVE-2011-2782Aug 3, 2011risk 0.00cvss —epss 0.01
The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
- CVE-2011-1435May 3, 2011risk 0.00cvss —epss 0.01
Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafted extension.
- CVE-2010-4176Dec 7, 2010risk 0.00cvss —epss 0.02
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
- CVE-2004-1778Dec 22, 2004risk 0.00cvss —epss 0.00
Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows local users to modify language files and possibly conduct social engineering or other attacks.
- CVE-2002-0493Aug 12, 2002risk 0.00cvss —epss 0.04
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.