目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-276 缺省权限不正确 类漏洞列表 527

CWE-276 缺省权限不正确 类弱点 527 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-276 属于权限配置不当类漏洞，指软件在安装过程中将文件权限错误地设置为允许任何用户修改。攻击者通常利用此缺陷，通过篡改关键配置文件或二进制文件植入恶意代码，从而在后续执行中获得未授权访问或提升权限。开发者应避免使用过于宽松的默认权限，遵循最小权限原则，在部署时显式设置严格的访问控制，确保仅授权用户具备读写执行权限，从而从源头消除安全隐患。

MITRE CWE 官方描述
CWE：CWE-276 Incorrect Default Permissions 英文：在安装过程中，已安装文件的权限被设置为允许任何人修改这些文件。
常见影响 (1)
Confidentiality, Integrity Read Application Data, Modify Application Data
缓解措施 (2)
Architecture and Design, Operation The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-94460 IRISPowerscan 安装账户默认权限分配不当漏洞 — IRISPowerscan 7.2 High 2026-11-04
CVE-2026-91895 Dell AWCC 6.14.54.0 前版本默认权限漏洞 — Alienware Command Center (AWCC) 7.1 High 2026-11-02
CVE-2026-114148 ASP.NET Core 提权漏洞 — .NET 10.0 installed on Linux 7.8 High 2026-10-29
CVE-2026-112357 GFI KerioConnect KOFF 提权漏洞 — GFI KerioConnect 7.8 High 2026-10-28
CVE-2026-113345 日本国土交通省系统文件权限漏洞致代码执行 — Electronic delivery item Inspection Support System 8.5 High 2026-10-26
CVE-2026-115253 WatchGuard Agent 日志目录权限分配错误导致本地日志篡改漏洞 — WatchGuard Agent 7.3 High 2026-10-22
CVE-2026-107571 hMailServer 默认权限配置不当漏洞 — hMailServer 7.8 High 2026-10-19
CVE-2026-85300 Apache Camel 默认权限导致私钥泄露 — Apache Camel 5.5 Medium 2026-10-19
CVE-2026-108072 共享启动脚本权限设置不当导致远程代码执行漏洞 — TSplus Remote Access 5.4 Medium 2026-10-14
CVE-2026-110359 Hyland Desktop Host 本地提权漏洞 — Desktop Host 7.8 High 2026-10-14
CVE-2026-105009 Windows Server Update Service 权限提升漏洞 — Windows Server 2012 7.5 High 2026-10-13
CVE-2026-108503 中兴Z80 Ultra 信息泄露漏洞 — Z80 Ultra 3.3 Low 2026-10-10
CVE-2026-107332 AWS Toolkit for Visual Studio Code 缓存凭证权限漏洞 — aws-toolkit-vscode 5.5 Medium 2026-10-08
CVE-2026-107573 hMailServer 默认权限配置错误漏洞 — hMailServer 7.8 High 2026-10-08
CVE-2026-78413 Velociraptor SysmonLogForward客户端监控工件提权漏洞 — Velociraptor 5.5 Medium 2026-10-05
CVE-2026-100718 Froxlor <2.3.12 通过 EmailSender.add 绕过身份验证漏洞 — froxlor 7.1 High 2026-09-26
CVE-2026-6718 IBM Concert软件多个漏洞 — Concert 6.2 Medium 2026-09-23
CVE-2026-82165 Dell Integration Suite 6.7.2权限缺陷 — Command | Integration Suite for System Center 5.5 Medium 2026-09-21
CVE-2026-82163 Dell vPro 4.7.2前默认权限不当致信息泄露 — Command | Intel vPro Out of Band 5.5 Medium 2026-09-21
CVE-2026-92252 WatchDog反病毒软件安装目录权限错误 — Anti-Virus 5.9 Medium 2026-09-20
CVE-2026-87886 Acronis Backup插件本地提权：不安全文件权限 — Acronis Backup plugin for cPanel & WHM - - 2026-09-17
CVE-2026-86359 Dell Repository Manager 3.5.2前默认权限不当提权 — Repository Manager 8.5 High 2026-09-16
CVE-2026-48722 Nextflow auth login默认权限错误漏洞 — nextflow 5.5 Medium 2026-09-15
CVE-2026-11813 Lenovo FileZ Client 权限许可和访问控制问题漏洞 — FileZ Client 7.8 High 2026-09-10
CVE-2026-52766 YesWiki 权限许可和访问控制问题漏洞 — yeswiki 9.1 Critical 2026-09-04
CVE-2026-77393 Inductive Automation Ignition 权限许可和访问控制问题漏洞 — Ignition 8.8 High 2026-09-04
CVE-2026-81302 JAL PALLET CONTROL 权限许可和访问控制问题漏洞 — PALLET CONTROL 8.5 High 2026-09-04
CVE-2026-9634 Rockwell Automation Redundancy Module Configuration Tool 权限许可和访问控制问题漏洞 — Redundancy Module Configuration Tool 7.0 High 2026-09-01
CVE-2026-9633 Rockwell Automation Redundancy Module Configuration Tool 权限许可和访问控制问题漏洞 — Redundancy Module Configuration Tool 7.0 High 2026-09-01
CVE-2026-81682 Tobi OpenSSL Encrypt 权限许可和访问控制问题漏洞 — openssl_encrypt 6.2 Medium 2026-08-27

CWE-276（缺省权限不正确） 是常见的弱点类别，本平台收录该类弱点关联的 527 条 CVE 漏洞。