Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

CVEs (1,579)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19118 2Djangoproject Fedoraproject 2Django Fedora Jun 17, 2026 Dec 2, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the...Show more Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)Show less
CVE-2019-19490 1Litemanager 1Litemanager Jun 17, 2026 Dec 2, 2019 N/A· v4 7.3 HIGH· v3 4.4 MEDIUM· v2 LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe.
CVE-2018-20090 1Cloudera 1Data Science Workbench Nov 21, 2024 Nov 26, 2019 N/A· v4 8.3 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder.
CVE-2018-17860 1Cloudera 1Cdh Nov 21, 2024 Nov 26, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.
CVE-2018-2025 1Ibm 2Spectrum Protect Spectrum Protect For Virtual Environments Nov 21, 2024 Nov 25, 2019 N/A· v4 4.4 MEDIUM· v3 3.6 LOW· v2 IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory that are read/writable by everyone. IBM X-Force ID: 155551.
CVE-2019-13662 1Google 1Chrome Jun 17, 2026 Nov 25, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2012-5578 1Python 1Keyring Nov 21, 2024 Nov 25, 2019 N/A· v4 6.2 MEDIUM· v3 2.1 LOW· v2 Python keyring has insecure permissions on new databases allowing world-readable files to be created
CVE-2019-19202 1Vtiger 1Vtiger Crm Jun 17, 2026 Nov 21, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
CVE-2019-17421 1Zohocorp 2Manageengine Firewall Analyzer Manageengine Opmanager Jun 17, 2026 Nov 21, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a mal...Show more Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.Show less
CVE-2012-6136 3Debian FedoraprojectRedhat 7Debian Linux Enterprise LinuxEnterprise Linux Desktop+4 more Nov 21, 2024 Nov 20, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.
CVE-2019-14602 1Intel 1Nuvoton Consumer Infrared Jun 17, 2026 Nov 14, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2012-1157 2Fedoraproject Moodle 2Fedora Moodle Nov 21, 2024 Nov 14, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
CVE-2010-5108 2Debian Edgewall 2Debian Linux Trac Nov 21, 2024 Nov 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.
CVE-2019-4652 1Ibm 1Spectrum Protect Plus Jun 17, 2026 Nov 12, 2019 N/A· v4 7.1 HIGH· v3 3.6 LOW· v2 IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions....Show more IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963.Show less
CVE-2013-1425 2Debian Ldap Git Backup Project 2Debian Linux Ldap Git Backup Nov 21, 2024 Nov 7, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
CVE-2019-1982 1Cisco 4Firepower Services Software For Asa Firepower Threat DefenseSecure Firewall Management Center+1 more Aug 11, 2026 Nov 5, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated...Show more A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper handling of HTTP requests, including those communicated over a secure HTTPS connection, that contain maliciously crafted headers. An attacker could exploit this vulnerability by sending malicious requests to an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems, allowing attackers to deliver malicious content that would otherwise be blocked.Show less
CVE-2019-12752 1Symantec 1Sonar Jun 17, 2026 Nov 1, 2019 N/A· v4 6.1 MEDIUM· v3 4.1 MEDIUM· v2 The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident...Show more The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system.Show less
CVE-2019-18369 1Jetbrains 1Youtrack Jun 17, 2026 Oct 31, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
CVE-2019-18367 1Jetbrains 1Teamcity Jun 17, 2026 Oct 31, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
CVE-2019-18366 1Jetbrains 1Teamcity Jun 17, 2026 Oct 31, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

Previous 1...727374...79 Next