CWE-276— Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.— MITRE CWE catalog
1,759 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-276page 29 of 36
- CVE-2020-8357MEDIUMCVSS 5.5EG 5.52021-03-09
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-standard locations.
- CVE-2021-24031MEDIUMCVSS 5.5EG 5.52021-03-04
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writ…
- CVE-2020-0524MEDIUMCVSS 5.5EG 5.52021-02-17
Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access.
- CVE-2020-26941MEDIUMCVSS 5.5EG 5.52021-01-26
A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlink, due to insecure permissions. The possibility of exploiting this vulnerability…
- CVE-2020-27039MEDIUMCVSS 5.5EG 5.52020-12-15
In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for expl…
- CVE-2020-0468MEDIUMCVSS 5.5EG 5.52020-12-14
In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check. This could lead to local information disclosure with no additional execution pri…
- CVE-2020-24460MEDIUMCVSS 5.5EG 5.52020-11-12
Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local access.
- CVE-2020-0453MEDIUMCVSS 5.5EG 5.52020-11-10
In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed …
- CVE-2020-0448MEDIUMCVSS 5.5EG 5.52020-11-10
In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to …
- CVE-2020-0437MEDIUMCVSS 5.5EG 5.52020-11-10
In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service of emergency alerts with no additional execution privileges needed. User intera…
- CVE-2020-0415MEDIUMCVSS 5.5EG 5.52020-10-14
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed f…
- CVE-2020-0410MEDIUMCVSS 5.5EG 5.52020-10-14
In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
- CVE-2020-26088MEDIUMCVSS 5.5EG 5.52020-09-24
A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.
- CVE-2020-0316MEDIUMCVSS 5.5EG 5.52020-09-18
In Telephony, there is a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andr…
- CVE-2020-0315MEDIUMCVSS 5.5EG 5.52020-09-18
In Zen Mode, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
- CVE-2020-0311MEDIUMCVSS 5.5EG 5.52020-09-18
In InputManagerService, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: A…
- CVE-2020-0310MEDIUMCVSS 5.5EG 5.52020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
- CVE-2020-0307MEDIUMCVSS 5.5EG 5.52020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
- CVE-2020-0304MEDIUMCVSS 5.5EG 5.52020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
- CVE-2020-0302MEDIUMCVSS 5.5EG 5.52020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
- CVE-2020-0295MEDIUMCVSS 5.5EG 5.52020-09-18
In Telecom, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersio…
- CVE-2020-0294MEDIUMCVSS 5.5EG 5.52020-09-18
In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction…
- CVE-2020-0285MEDIUMCVSS 5.5EG 5.52020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
- CVE-2020-0284MEDIUMCVSS 5.5EG 5.52020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
- CVE-2020-0276MEDIUMCVSS 5.5EG 5.52020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
- CVE-2020-0426MEDIUMCVSS 5.5EG 5.52020-09-17
In SyncManager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: …
- CVE-2020-0343MEDIUMCVSS 5.5EG 5.52020-09-17
In NetworkStatsService, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for expl…
- CVE-2020-0317MEDIUMCVSS 5.5EG 5.52020-09-17
In UsageStatsManager, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi…
- CVE-2020-0312MEDIUMCVSS 5.5EG 5.52020-09-17
In Battery Saver, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: Android…
- CVE-2020-0308MEDIUMCVSS 5.5EG 5.52020-09-17
In Window Manager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: Androi…
- CVE-2020-0297MEDIUMCVSS 5.5EG 5.52020-09-17
In devicepolicy service, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: …
- CVE-2020-0296MEDIUMCVSS 5.5EG 5.52020-09-17
In ADB server and USB server, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Prod…
- CVE-2020-0293MEDIUMCVSS 5.5EG 5.52020-09-17
In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for…
- CVE-2020-0390MEDIUMCVSS 5.5EG 5.52020-09-17
In the app zygote SE Policy, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: …
- CVE-2020-8346MEDIUMCVSS 5.5EG 5.52020-09-15
A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could allow configuration files to be written to non-standard locations.
- CVE-2020-0107MEDIUMCVSS 5.5EG 5.52020-07-17
In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is…
- CVE-2020-15578MEDIUMCVSS 5.5EG 5.52020-07-07
An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-2020-17270 (July 2020).
- CVE-2020-0121MEDIUMCVSS 5.5EG 5.52020-06-10
In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed…
- CVE-2020-0116MEDIUMCVSS 5.5EG 5.52020-06-10
In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. Us…
- CVE-2020-13867MEDIUMCVSS 5.5EG 5.52020-06-05
Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files).
- CVE-2020-8798MEDIUMCVSS 5.5EG 5.52020-04-23
httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network.
- CVE-2020-0023MEDIUMCVSS 5.5EG 5.52020-02-13
In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts o…
- CVE-2019-5593MEDIUMCVSS 5.5EG 5.52020-01-23
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0…
- CVE-2020-0009MEDIUMCVSS 5.5EG 5.52020-01-08
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional executio…
- CVE-2019-8731MEDIUMCVSS 5.5EG 5.52019-12-18
A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fixed in iOS 13. Processing a maliciously crafted file may disclose user informati…
- CVE-2019-19460MEDIUMCVSS 5.5EG 5.52019-12-03
An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-…
- CVE-2012-6136MEDIUMCVSS 5.5EG 5.52019-11-20
tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.
- CVE-2013-1425MEDIUMCVSS 5.5EG 5.52019-11-07
ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
- CVE-2019-16355MEDIUMCVSS 5.5EG 5.52019-09-16
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
- CVE-2019-15716MEDIUMCVSS 5.5EG 5.52019-08-28
WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.
Map vulnerabilities like CWE-276 to your infrastructure
EchelonGraph correlates every CVE — across CWE-276 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →