CWE-276— Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.— MITRE CWE catalog

1,682 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-276page 5 of 34

CVE-2019-2173HIGHCVSS 7.8EG 7.8
2019-10-11
In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…
CVE-2019-2200HIGHCVSS 7.3EG 7.3
2020-02-13
In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permission bypass. This could lead to local escalation of privilege with User execution p…
CVE-2019-3687MEDIUMCVSS 4.0EG 4.0
2020-01-24
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 8…
CVE-2019-3688MEDIUMCVSS 5.1EG 5.1
2019-10-07
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This all…
CVE-2019-3689MEDIUMCVSS 5.1EG 5.1
2019-09-19
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This…
CVE-2019-3870MEDIUMCVSS 6.1EG 6.1
2019-04-09
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically…
CVE-2019-3944HIGHCVSS 7.5EG 7.5
2020-04-01
Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
CVE-2019-4001HIGHCVSS 7.8EG 7.8
2020-03-24
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
CVE-2019-4652HIGHCVSS 7.1EG 7.1
2019-11-12
IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170…
CVE-2019-5593MEDIUMCVSS 5.5EG 5.5
2020-01-23
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0…
CVE-2019-5687HIGHCVSS 7.1EG 7.1
2019-08-06
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorrect use of default permissions for an object exposes it to an unintended actor
CVE-2019-7588HIGHCVSS 6.7EG 7.0
2019-06-18
A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM …
CVE-2019-7656HIGHCVSS 7.8EG 7.8
2020-01-29
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core pr…
CVE-2019-8256CRITICALCVSS 9.8EG 9.8
2019-12-19
ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-8731MEDIUMCVSS 5.5EG 5.5
2019-12-18
A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fixed in iOS 13. Processing a maliciously crafted file may disclose user informati…
CVE-2019-8777LOWCVSS 2.4EG 2.4
2020-10-27
A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra.…
CVE-2019-9579HIGHCVSS 8.1EG 8.1
2022-12-26
An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g., an attacker with WRITE_XATTR can change permissions. This occurs because of a…
CVE-2019-9630HIGHCVSS 7.5EG 7.5
2019-07-08
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVE-2019-9679HIGHCVSS 8.8EG 8.8
2019-09-18
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDB…
CVE-2019-9682HIGHCVSS 8.1EG 8.1
2020-05-13
Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If…
CVE-2019-9943HIGHCVSS 7.5EG 7.5
2020-06-17
In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may be circumvented during certain operations such as move and delete, because grou…
CVE-2020-0009MEDIUMCVSS 5.5EG 5.5
2020-01-08
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional executio…
CVE-2020-0023MEDIUMCVSS 5.5EG 5.5
2020-02-13
In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts o…
CVE-2020-0024HIGHCVSS 7.8EG 7.8
2020-05-14
In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2020-0107MEDIUMCVSS 5.5EG 5.5
2020-07-17
In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is…
CVE-2020-0116MEDIUMCVSS 5.5EG 5.5
2020-06-10
In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. Us…
CVE-2020-0121MEDIUMCVSS 5.5EG 5.5
2020-06-10
In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed…
CVE-2020-0122MEDIUMCVSS 6.7EG 6.7
2020-07-17
In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges…
CVE-2020-0133HIGHCVSS 7.3EG 7.3
2020-06-11
In MockLocationAppPreferenceController.java, it is possible to mock the GPS location of the device due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is nee…
CVE-2020-0135MEDIUMCVSS 4.4EG 4.4
2020-06-11
In dump of RollbackManagerServiceImpl.java, there is a possible backup metadata exposure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not ne…
CVE-2020-0137HIGHCVSS 7.8EG 7.8
2020-06-11
In setIPv6AddrGenMode of NetworkManagementService.java, there is a possible bypass of networking permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed…
CVE-2020-0202HIGHCVSS 7.8EG 7.8
2020-06-11
In onHandleIntent of TraceService.java, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. This could lead to local escalation of privilege with no additional execut…
CVE-2020-0208HIGHCVSS 7.8EG 7.8
2020-06-11
In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0209HIGHCVSS 7.8EG 7.8
2020-06-11
In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0215HIGHCVSS 7.8EG 7.8
2020-06-11
In onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due to a permissions bypass. This could lead to local escalation of privilege that exposes a pairing Bluetooth MAC address with no additional exe…
CVE-2020-0227HIGHCVSS 7.8EG 7.8
2020-07-17
In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background,…
CVE-2020-0275HIGHCVSS 7.8EG 7.8
2020-09-17
In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permissions bypass. This could lead to local escalation of privilege, with no additional execution privile…
CVE-2020-0276MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0284MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0285MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0293MEDIUMCVSS 5.5EG 5.5
2020-09-17
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for…
CVE-2020-0294MEDIUMCVSS 5.5EG 5.5
2020-09-18
In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction…
CVE-2020-0295MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telecom, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersio…
CVE-2020-0296MEDIUMCVSS 5.5EG 5.5
2020-09-17
In ADB server and USB server, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Prod…
CVE-2020-0297MEDIUMCVSS 5.5EG 5.5
2020-09-17
In devicepolicy service, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: …
CVE-2020-0298HIGHCVSS 7.8EG 7.8
2020-09-18
In Bluetooth, there is a possible control over Bluetooth enabled state due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e…
CVE-2020-0299HIGHCVSS 7.8EG 7.8
2020-09-18
In Bluetooth, there is a possible spoofing of bluetooth device metadata due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitat…
CVE-2020-0302MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0304MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0307MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…

Map vulnerabilities like CWE-276 to your infrastructure

EchelonGraph correlates every CVE — across CWE-276 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →