Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

CVEs (1,579)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-9474 1Simpolio Project 1Simpolio Nov 21, 2024 Oct 10, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
CVE-2019-17365 1Nixos 1Nix Jun 17, 2026 Oct 9, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.
CVE-2019-17383 1Netaddr Project 1Netaddr Jun 17, 2026 Oct 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
CVE-2019-17124 1Kramerav 1Viaware Jun 17, 2026 Oct 9, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
CVE-2019-16913 1Pcprotect 1Antivirus Jun 17, 2026 Oct 7, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders....Show more PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as LocalSystem. This allows any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a Trojan horse.Show less
CVE-2019-3688 1Suse 1Suse Linux Enterprise Server Jun 17, 2026 Oct 7, 2019 N/A· v4 7.1 HIGH· v3 6.6 MEDIUM· v2 The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 pe...Show more The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binaryShow less
CVE-2019-17056 1Linux 1Linux Kernel Jun 17, 2026 Oct 1, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.
CVE-2019-17054 1Linux 1Linux Kernel Jun 17, 2026 Oct 1, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.
CVE-2019-17053 1Linux 1Linux Kernel Jun 17, 2026 Oct 1, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd...Show more ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.Show less
CVE-2019-17052 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraLinux Kernel+1 more Jun 17, 2026 Oct 1, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.
CVE-2018-19592 1Corsair 1Link Nov 21, 2024 Sep 27, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\...Show more The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441.Show less
CVE-2019-12670 1Cisco 1Ios Jun 17, 2026 Sep 25, 2019 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is...Show more A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is due to insufficient file permissions. An attacker could exploit this vulnerability by modifying files that they should not have access to. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container.Show less
CVE-2019-3689 1Linux Nfs 1Nfs Utils Jun 17, 2026 Sep 19, 2019 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by...Show more The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.Show less
CVE-2019-9679 1Dahuasecurity 9Ipc Hdbw4x2x Firmware Ipc Hdw1x2x FirmwareIpc Hdw2x2x Firmware+6 more Jun 17, 2026 Sep 18, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,...Show more Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019.Show less
CVE-2019-16355 1Beego 1Beego Jun 17, 2026 Sep 16, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
CVE-2019-16106 1Humanica 1Humatrix Jun 17, 2026 Sep 10, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdN...Show more The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdNP fields.Show less
CVE-2019-16186 1Limesurvey 1Limesurvey Jun 17, 2026 Sep 9, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.
CVE-2019-16185 1Limesurvey 1Limesurvey Jun 17, 2026 Sep 9, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
CVE-2019-16183 1Limesurvey 1Limesurvey Jun 17, 2026 Sep 9, 2019 N/A· v4 2.7 LOW· v3 4.0 MEDIUM· v2 In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
CVE-2019-15716 1Wtfutil 1Wtf Jun 17, 2026 Aug 28, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Previous 1...747576...79 Next