Filtered by CWE-281
Filtered by vendor Subscriptions
Total 279 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-18890 1 Puppycms 1 Puppycms 2024-11-21 9.8 Critical
Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php.
CVE-2020-18329 1 Carel 3 Pcoweb Card Bios, Pcoweb Card Boot, Pcoweb Card Web 2024-11-21 7.5 High
An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface.
CVE-2020-16910 1 Microsoft 11 Windows 10, Windows 10 1507, Windows 10 1607 and 8 more 2024-11-21 6.2 Medium
<p>A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location.</p> <p>To exploit this vulnerability, an attacker could run a specially crafted application to bypass Unified Extensible Firmware Interface (UEFI) variable security in Windows.</p> <p>The security update addresses the vulnerability by correcting security feature behavior to enforce permissions.</p>
CVE-2020-15496 1 Acronis 1 True Image 2024-11-21 7.8 High
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
CVE-2020-15113 3 Etcd, Fedoraproject, Redhat 4 Etcd, Fedora, Openshift and 1 more 2024-11-21 5.7 Medium
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).
CVE-2020-14958 1 Gogs 1 Gogs 2024-11-21 6.5 Medium
In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
CVE-2020-13763 1 Joomla 1 Joomla\! 2024-11-21 7.5 High
In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
CVE-2020-13308 1 Gitlab 1 Gitlab 2024-11-21 2.7 Low
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance.
CVE-2020-13282 1 Gitlab 1 Gitlab 2024-11-21 3.1 Low
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.
CVE-2020-13230 3 Cacti, Debian, Fedoraproject 3 Cacti, Debian Linux, Fedora 2024-11-21 4.3 Medium
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).
CVE-2020-12744 1 Verint 1 Desktop And Process Analytics 2024-11-21 7.8 High
The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.
CVE-2020-12353 1 Intel 1 Data Center Manager 2024-11-21 6.5 Medium
Improper permissions in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable denial of service via network access.
CVE-2020-12345 1 Intel 1 Data Center Manager 2024-11-21 7.8 High
Improper permissions in the installer for the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-12335 1 Intel 1 Processor Identification Utility 2024-11-21 7.8 High
Improper permissions in the installer for the Intel(R) Processor Identification Utility before version 6.4.0603 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-12334 1 Intel 1 Advisor Tools 2024-11-21 7.8 High
Improper permissions in the installer for the Intel(R) Advisor tools before version 2020 Update 2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-12332 1 Intel 1 Hid Event Filter Driver 2024-11-21 7.8 High
Improper permissions in the installer for the Intel(R) HID Event Filter Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-12330 1 Intel 2 Falcon 8\+ Uas Asctec Thermal Viewer, Falcon 8\+ Uas Asctec Thermal Viewer Firmware 2024-11-21 7.8 High
Improper permissions in the installer for the Intel(R) Falcon 8+ UAS AscTec Thermal Viewer, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-10083 1 Gitlab 1 Gitlab 2024-11-21 9.1 Critical
GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.
CVE-2020-0405 1 Google 1 Android 2024-11-21 7.8 High
In NetworkStackNotifier, there is a possible permissions bypass due to an unsafe implicit PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157475111
CVE-2019-7282 3 Debian, Fedoraproject, Netkit 3 Debian Linux, Fedora, Netkit 2024-11-21 5.9 Medium
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. This is similar to CVE-2018-20685.