← Back
CWE-276

1,579 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

JSON object

Loading...

CVEs (1,579)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-40004
1Huawei
1Harmonyos
Jun 17, 2026
Jan 10, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality.
CVE-2021-39967
1Huawei
3Emui
HarmonyosMagic Ui
Jun 17, 2026
Jan 3, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2021-37132
1Huawei
1Harmonyos
Jun 17, 2026
Jan 3, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without p...Show more
PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may cause that Third-party apps can obtain the complete list of Harmony apps without permission.Show less
CVE-2021-45335
1Avas!t
1Antivirus
Jun 17, 2026
Dec 27, 2021
N/A· v4
8.8 HIGH· v3
7.2 HIGH· v2
Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files.
CVE-2021-21912
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21911
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21910
1Advantech
1R Seenet
Jun 17, 2026
Dec 22, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privile...Show more
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-44858
1Mediawiki
1Mediawiki
Jun 17, 2026
Dec 20, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a priv...Show more
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.Show less
CVE-2021-0979
1Google
1Android
Jun 17, 2026
Dec 15, 2021
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lea...Show more
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-191772737Show less
CVE-2021-43326
1Automox
1Automox
Jun 17, 2026
Dec 15, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
CVE-2021-43325
1Automox
1Automox
Jun 17, 2026
Dec 15, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression.
CVE-2021-44833
1Amazon
1Aws Opensearch
Jun 17, 2026
Dec 12, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.
CVE-2021-21957
1Dreamreport
1Remote Connector
Jun 17, 2026
Dec 8, 2021
N/A· v4
7.3 HIGH· v3
6.8 MEDIUM· v2
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can p...Show more
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-42711
1Barracuda
1Network Access Client
Jun 17, 2026
Dec 1, 2021
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges when an unprivileged user performs a repair operation.
CVE-2021-31822
1Octopus
1Tentacle
Jun 17, 2026
Nov 24, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to g...Show more
When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to gain privileged access.Show less
CVE-2021-44140
1Apache
1Jspwiki
Jun 17, 2026
Nov 24, 2021
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running t...Show more
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.Show less
CVE-2021-37030
1Huawei
2Emui
Magic Ui
Jun 17, 2026
Nov 23, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVE-2021-33071
1Intel
1Oneapi Rendering Toolkit
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-33062
1Intel
1Vtune Profiler
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-0065
1Intel
137265 Firmware
9260 FirmwareAc 3165 Firmware+10 more
Jun 17, 2026
Nov 17, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.