CWE-276 Incorrect Default Permissions
baseDuring installation, installed file permissions are set to allow anyone to modify those files.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (2179)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-87886US | —OT kritisch | KEV | ||
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Ba… | ||||
| CVE-2025-24085US | critical10.0OT kritisch | KEV | ||
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS… | ||||
| CVE-2024-55956US | critical9.8OT kritisch | KEV | ||
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the… | ||||
| CVE-2024-51378US | critical9.8OT kritisch | KEV | ||
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /… | ||||
| CVE-2023-29360US | —OT kritisch | KEV | ||
Microsoft Streaming Service Elevation of Privilege Vulnerability | ||||
| CVE-2022-22047US | high7.2OT kritisch | KEV | ||
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | ||||
| CVE-2022-22960US | high7.8OT kritisch | KEV | ||
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor… | ||||
| CVE-2022-22948US | medium6.5OT kritisch | KEV | ||
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may… | ||||
| CVE-2013-0632US | critical9.8OT kritisch | KEV | ||
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS compon… | ||||
| CVE-2017-11610US | high8.8OT hoch | Exploit | ||
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a… | ||||
| CVE-2023-29919US | critical9.1OT hoch | Exploit | ||
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted. | ||||
| CVE-2021-33393US | high8.8OT hoch | Exploit | ||
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could pote… | ||||
| CVE-2003-0150US | high9.0OT hoch | Exploit | ||
MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration fi… | ||||
| CVE-2012-3807US | critical9.8OT hoch | Exploit | ||
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution. | ||||
| CVE-2019-17124US | critical9.8OT hoch | Exploit | ||
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. | ||||
| CVE-1999-0554US | high10.0OT hoch | Exploit | ||
NFS exports system-critical data to the world, e.g. / or a password file. | ||||
| CVE-2000-0515US | high10.0OT hoch | Exploit | ||
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges. | ||||
| CVE-1999-0426US | critical9.8OT hoch | Exploit | ||
The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing. | ||||
| CVE-1999-0765US | high10.0OT hoch | Exploit | ||
SGI IRIX midikeys program allows local users to modify arbitrary files via a text editor. | ||||
| CVE-2023-31068US | critical9.8OT hoch | Exploit | ||
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\UserDesktop\… | ||||
03
Angriffsmuster (3)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan