Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Fail-open permission provisioning: when a plugin ships no authorization definition (config/permission.php), wildcard "allow all" access rules are built for every non-admin user group instead of failing closed. Installing or re-registering such a plugin silently grants all user groups full access to its admin and admin-API endpoints (privilege escalation, and
Authorization check fails open by returning True when an allowlist or whitelist is empty or not configured. Enforce fail-closed access control by returning False or raising an exception when no allowlist entries exist.
Fail-open access control detected: '$ALLOW' check returns True when the allowlist is empty or unconfigured. Access control checks should fail closed (return False) when no allowed entities are specified.
A role or authorization mapping is initialized with `defaultdict(lambda: True)`. This results in a fail-open access control policy where any route, handler, or action not explicitly mapped is granted access by default. Use `defaultdict(lambda: False)` or `defaultdict(bool)` to enforce fail-closed authorization.
File mode from archive header is used without masking permission bits, allowing setuid/setgid privilege escalation.
Unconditionally enabling command message filtering with 'EnableCommandMessageFiltering(true)' allows any MOOSDB client to send runtime command messages (such as network route reconfiguration) without explicit opt-in or authorization checks.
$SENSITIVE_PATH is created for writing through an API that cannot set file permissions, so it is created as 0666 & ~umask (typically 0644) and is readable by any local user that can reach it. Whoever reads it recovers the secret and can forge sessions, cookies or derived API keys (CWE-732). Create the file with os.open(..., os.O_WRONLY | os.O_CREAT | os.O_TR
Authorization check fails open when permissions list is empty ($permissions is empty -> permitted). This allows unauthenticated or unauthorized access to routes or actions that lack explicit permission definitions.
Insecure default exec configuration includes tailwindcss in execution whitelist.
Setting a command umask to 0 when preparing a process for execution disables file permission masking, allowing newly created files or disk images to be world-readable or world-writable.
A UNIX domain socket is created and configured with overly permissive permissions (e.g. 0777 or 0666). This allows unprivileged local users to connect to the socket and potentially escalate privileges.
Automount handler returns NULL or lacks transit management, which may lead to VFS mount option inheritance issues.
Writing to an existing sensitive config file without restricting its permissions beforehand can leave it world-readable if it was previously created with permissive permissions. Tighten permissions using `fs.chmod(file, 0o600)` before rewriting the file.
A Stimulus controller unconditionally initializes form bounds from default cookie values. If this form is used for existing records, this silently overwrites the record's existing configuration with defaults upon saving, which can downgrade strict security bounds. Protect the value assignment with an edit-mode persistence check to prioritize the existing rec
Files or directories are being created using generic, convenience API functions (`std::fs::write`, `std::fs::create_dir_all`, etc.) that rely entirely on the system's default umask on Unix architectures. This commonly results in world-readable permissions (e.g., 0644 or 0755), introducing a significant risk of exposing sensitive data such as configurations,
Writing sensitive data or output files using standard `open()` creates files with default umask permissions (often 0644), potentially exposing contents to other local users. Set restrictive permissions using `os.fchmod`/`os.chmod`, pass a custom `opener` to `open()`, or use a wrapper that sets 0o600 permissions upon creation.
The NSIS installer script applies file and directory permission restrict policies exclusively when run with administrative privileges. If the installer runs as a standard user in a shared or writable location, the installation directory will retain overly permissive default permissions inherited from the parent location. This is a local privilege escalation
Setting `ReadOnlyPort` to 0 in Kubelet configuration structs causes the field to be stripped during JSON serialization due to the upstream `omitempty` tag. As a result, kubelet ignores the 0 value and binds to the default unauthenticated port (10255), exposing sensitive cluster information. Set the read-only port dynamically via CLI flags (e.g., `--read-only
Method `$METHOD` writes credential/token data to a file via `open(self.$PATH, "w", ...)` without restricting the file's permissions. The created file inherits the process umask (typically yielding mode `rw-r--r--` / 0644), which exposes the stored secret to any other local user or process running as a different UID (CWE-276 — Incorrect Default Permissions; C
Form processing iterates over field definitions and accepts input without verifying whether the field is marked as visible or enabled, potentially allowing hidden or restricted fields to be altered.
Administrator password is hardcoded to a well-known weak/default value in a PHP configuration file shipped with the legacy 'Adult Video Script' (AVSCMS) application. Shipping a default credential (e.g., 'admin'/'admin') in version control allows any unauthenticated attacker who can reach the admin login endpoint to gain full administrative access to any depl
A Time-Of-Check to Time-Of-Use (TOCTOU) vulnerability exists when a file is created using the built-in `open()` and its permissions are subsequently altered using `chmod`. An attacker can read or modify the file in the small window between creation and the permission change. Securely create the file with the correct permissions atomically by using `os.fdopen
The systemd socket unit defines a UNIX domain socket or FIFO (`ListenFIFO`, `ListenStream`, etc.) without specifying `SocketMode`. By default, systemd creates these with world-writable (0666) permissions. This can allow unprivileged local users to send data to the service, potentially leading to privilege escalation or unauthorized access. Specify `SocketMod
Privileged image admission policy for attacker-controlled extfs content is enforced only through the "allow container ..." directives and never restricted in setuid-root mode: this image-loading function has no `!userNS && !cfg.File.AllowSetuidMountExtfs` gate. With the setuid starter an unprivileged user can make the privileged starter loop-attach and kerne
