← Back
CWE-276

1,555 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

JSON object

Loading...

CVEs (1,555)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-21912
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21911
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21910
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-44858
1Mediawiki
1Mediawiki
Jun 17, 2026
Dec 20, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a priv...Show more
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.Show less
CVE-2021-0979
1Google
1Android
Jun 17, 2026
Dec 15, 2021
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lea...Show more
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191772737Show less
CVE-2021-43326
1Automox
1Automox
Jun 17, 2026
Dec 15, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
CVE-2021-43325
1Automox
1Automox
Jun 17, 2026
Dec 15, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.
CVE-2021-44833
1Amazon
1Aws Opensearch
Jun 17, 2026
Dec 12, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.
CVE-2021-21957
1Dreamreport
1Remote Connector
Jun 17, 2026
Dec 8, 2021
N/A· v4
7.3 HIGH· v3
6.8 MEDIUM· v2
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can p...Show more
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-42711
1Barracuda
1Network Access Client
Jun 17, 2026
Dec 1, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges when an unprivileged user performs a repair operation.
CVE-2021-31822
1Octopus
1Tentacle
Jun 17, 2026
Nov 24, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to g...Show more
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to gain privileged access.Show less
CVE-2021-44140
1Apache
1Jspwiki
Jun 17, 2026
Nov 24, 2021
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running t...Show more
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.Show less
CVE-2021-37030
1Huawei
2Emui
Magic Ui
Jun 17, 2026
Nov 23, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVE-2021-33071
1Intel
1Oneapi Rendering Toolkit
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-33062
1Intel
1Vtune Profiler
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-0065
1Intel
137265 Firmware
9260 FirmwareAc 3165 Firmware+10 more
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-8741
1Intel
1Thunderbolt Non Dch Driver
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-33092
1Intel
1Nuc M15 Laptop Kit Hid Event Filter Driver Pack
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via l...Show more
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access.Show less
CVE-2021-33090
1Intel
1Nuc Hdmi Firmware Update Tool
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable es...Show more
Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.Show less
CVE-2021-33088
1Intel
1Nuc M15 Laptop Kit Integrated Sensor Hub Driver Pack
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege...Show more
Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access.Show less