CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-276

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-17383 276 2019-10-09 2019-10-15
7.5
None Remote Low Not required Partial Partial Partial
The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
2 CVE-2019-17365 276 2019-10-09 2019-10-11
4.6
None Local Low Not required Partial Partial Partial
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.
3 CVE-2019-17124 276 2019-10-09 2019-10-15
10.0
None Remote Low Not required Complete Complete Complete
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
4 CVE-2019-17056 276 2019-10-01 2019-10-08
2.1
None Local Low Not required None Partial None
llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.
5 CVE-2019-17054 276 2019-10-01 2019-10-08
2.1
None Local Low Not required None Partial None
atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.
6 CVE-2019-17053 276 2019-10-01 2019-10-08
2.1
None Local Low Not required None Partial None
ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.
7 CVE-2019-17052 276 2019-10-01 2019-10-08
2.1
None Local Low Not required None Partial None
ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.
8 CVE-2019-16355 276 2019-09-16 2019-09-17
2.1
None Local Low Not required Partial None None
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
9 CVE-2019-16186 276 2019-09-09 2019-09-10
6.5
None Remote Low Single system Partial Partial Partial
In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.
10 CVE-2019-16185 276 2019-09-09 2019-09-10
6.5
None Remote Low Single system Partial Partial Partial
In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
11 CVE-2019-16183 276 2019-09-09 2019-09-10
4.0
None Remote Low Single system None Partial None
In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
12 CVE-2019-16106 276 2019-09-10 2019-09-11
5.0
None Remote Low Not required None Partial None
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdNP fields.
13 CVE-2019-14995 276 2019-09-11 2019-09-16
5.0
None Remote Low Not required Partial None None
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.
14 CVE-2019-11738 276 Bypass 2019-09-27 2019-10-05
6.8
None Remote Medium Not required Partial Partial Partial
If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
15 CVE-2019-9679 276 2019-09-18 2019-09-19
6.5
None Remote Low Single system Partial Partial Partial
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.
16 CVE-2019-3688 276 2019-10-07 2019-10-11
6.6
None Local Low Not required None Complete Complete
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary
17 CVE-2018-19592 276 Exec Code 2019-09-27 2019-10-01
7.2
None Local Low Not required Complete Complete Complete
The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441.
18 CVE-2018-14650 276 2018-09-27 2019-10-09
1.9
None Local Medium Not required Partial None None
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.
19 CVE-2018-13287 276 +Info 2019-04-01 2019-10-09
4.0
None Remote Low Single system Partial None None
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.
20 CVE-2018-13286 276 +Info 2019-04-01 2019-10-09
4.0
None Remote Low Single system Partial None None
Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.
21 CVE-2018-12175 276 2018-09-12 2019-10-02
4.6
None Local Low Not required Partial Partial Partial
Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged user to escalate privileges via local access.
22 CVE-2018-11906 276 2018-11-27 2019-10-02
7.2
None Local Low Not required Complete Complete Complete
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs.
23 CVE-2018-9085 276 2018-11-16 2019-10-02
4.0
None Remote Low Single system None Partial None
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.
24 CVE-2018-8848 276 2018-09-26 2019-10-09
5.0
None Remote Low Not required Partial None None
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.
25 CVE-2018-7535 276 +Priv 2018-07-13 2019-10-02
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files because of weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges or obtain maximum control over the product.
26 CVE-2018-7533 276 2018-03-14 2019-10-09
7.2
None Local Low Not required Complete Complete Complete
An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation of privileges that gives the actor full control over the system.
27 CVE-2018-6683 276 Bypass 2018-07-23 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.
28 CVE-2018-6261 276 DoS Exec Code 2018-10-02 2019-10-02
4.4
None Local Medium Not required Partial Partial Partial
NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, which may to code execution, denial of service, or escalation of privileges by users with system access.
29 CVE-2018-5313 276 Exec Code 2018-03-08 2019-10-02
7.2
None Local Low Not required Complete Complete Complete
A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions. The specific flaw exists within the access control that is set and modified during the installation of the product. The product sets weak access control restrictions. An attacker can leverage this vulnerability to execute arbitrary code under the context of Administrator, the IUSR account, or SYSTEM.
30 CVE-2018-0023 276 2018-04-11 2019-10-09
2.1
None Local Low Not required None Partial None
JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.
31 CVE-2017-1000089 276 2017-10-04 2019-10-02
5.0
None Remote Low Not required None Partial None
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
32 CVE-2017-1000084 276 2017-10-04 2019-10-02
4.0
None Remote Low Single system None Partial None
Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
33 CVE-2017-16522 276 Exec Code 2017-11-03 2019-10-02
9.0
None Remote Low Single system Complete Complete Complete
MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute.
34 CVE-2017-16128 276 2018-06-06 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
35 CVE-2017-16127 276 2018-06-06 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
36 CVE-2017-15131 276 2018-01-09 2019-10-02
4.6
None Local Low Not required Partial Partial Partial
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
37 CVE-2017-14427 276 2017-09-13 2019-10-02
2.1
None Local Low Not required Partial None None
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_root permissions.
38 CVE-2017-14425 276 2017-09-13 2019-10-02
2.1
None Local Low Not required Partial None None
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permissions.
39 CVE-2017-14424 276 2017-09-13 2019-10-02
2.1
None Local Low Not required Partial None None
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions.
40 CVE-2017-12763 276 +Priv 2017-08-29 2019-10-02
9.0
None Remote Low Single system Complete Complete Complete
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files.
41 CVE-2017-12699 276 2017-09-08 2019-10-09
3.6
None Local Low Not required Partial Partial None
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
42 CVE-2017-12230 276 2017-09-28 2019-10-09
9.0
None Remote Low Single system Complete Complete Complete
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the affected software. An attacker could exploit this vulnerability by using the web UI of the affected software to create a new user and then logging into the web UI as the newly created user. A successful exploit could allow the attacker to elevate their privileges on the affected device. This vulnerability affects Cisco devices that are running a vulnerable release Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuy83062.
43 CVE-2017-11741 276 Exec Code 2017-08-08 2019-10-02
7.2
None Local Low Not required Complete Complete Complete
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts.
44 CVE-2017-11610 276 Exec Code 2017-08-23 2019-10-02
9.0
None Remote Low Single system Complete Complete Complete
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
45 CVE-2017-8625 276 Bypass 2017-08-08 2019-10-02
6.8
None Remote Medium Not required Partial Partial Partial
Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) policies due to Internet Explorer failing to validate UMCI policies, aka "Internet Explorer Security Feature Bypass Vulnerability".
46 CVE-2017-7968 276 2017-05-19 2019-10-09
7.2
None Local Low Not required Complete Complete Complete
An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation, Wonderware InduSoft Web Studio creates a new directory and two files, which are placed in the system's path and can be manipulated by non-administrators. This could allow an authenticated user to escalate his or her privileges.
47 CVE-2017-7794 276 2018-06-11 2019-10-02
4.6
None Local Low Not required Partial Partial Partial
On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.
48 CVE-2017-7761 276 2018-06-11 2019-10-02
3.6
None Local Low Not required None Partial Partial
The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
49 CVE-2017-6404 276 2017-03-02 2019-10-02
2.1
None Local Low Not required None Partial None
An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofing of log data.
50 CVE-2017-5686 276 2017-04-03 2019-10-02
2.1
None Local Low Not required Partial None None
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
Total number of vulnerabilities : 60   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.