CWE-275
01
vulnerabilities (245)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22948US | medium6.5OT critical | KEV | ||
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may… | ||||
| CVE-2019-11510US | critical10.0OT critical | KEV | ||
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to p… | ||||
| CVE-2018-15379US | critical9.8 | Exploit | ||
A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an… | ||||
| CVE-2017-16887US | critical9.8 | Exploit | ||
The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services can re… | ||||
| CVE-2014-1632US | high8.1 | Exploit | ||
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. | ||||
| CVE-2014-1631US | high7.5 | Exploit | ||
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php. | ||||
| CVE-2017-17876US | high7.5 | Exploit | ||
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter. | ||||
| CVE-2023-36664US | high7.8 | Exploit | ||
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). | ||||
| CVE-2022-30594US | high7.8OT elevated | Exploit | ||
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. | ||||
| CVE-2019-8452US | high7.8 | Exploit | ||
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will g… | ||||
| CVE-1999-0589US | high10.0 | — | ||
A system-critical Windows NT registry key has inappropriate permissions. | ||||
| CVE-1999-0591US | high10.0 | — | ||
An event log in Windows NT has inappropriate access permissions. | ||||
| CVE-1999-0664US | high10.0 | — | ||
An application-critical Windows NT registry key has inappropriate permissions. | ||||
| CVE-1999-1138US | high10.0OT elevated | — | ||
SCO UNIX System V/386 Release 3.2, and other SCO products, installs the home directories (1) /tmp for the dos user, and (2) /usr/tmp for the asg user, which allows other users to g… | ||||
| CVE-2023-32002US | critical9.8OT elevated | — | ||
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users usin… | ||||
| CVE-2019-12450US | critical9.8OT elevated | — | ||
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permission… | ||||
| CVE-2017-6513US | critical9.9 | — | ||
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual ma… | ||||
| CVE-2024-13189US | critical9.8 | — | ||
A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The… | ||||
| CVE-2023-44809US | critical9.8 | — | ||
D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. | ||||
| CVE-2023-3759US | critical9.8 | — | ||
A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issues. It is possible to… | ||||
02
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan