CWE-275 · Permission Issues

113 CVEs classified under CWE-275 (Permission Issues). Browse by severity and year.

Top CVEs for CWE-275
CVESeverityScorePublishedSummary
CVE-2017-6513Critical9.92017-03-11The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to con…
CVE-2021-22566Critical9.82022-01-18An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T…
CVE-2017-17060Critical9.82019-05-23OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVE-2018-15379Critical9.82018-10-05A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote…
CVE-2017-16887Critical9.82018-01-12The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t…
CVE-2023-39399Critical9.12023-08-13Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho…
CVE-2023-39398Critical9.12023-08-13Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho…
CVE-2022-0742Critical9.12022-03-18Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or…
CVE-2019-2177High8.82019-09-05In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could le…
CVE-2013-3703High8.82018-06-08The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove us…
CVE-2016-8520High8.82018-02-15HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated…
CVE-2017-11463High8.82017-12-11In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/upd…
CVE-2015-5153High8.82017-08-18Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an o…
CVE-2016-4924High8.42017-10-13An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE image…
CVE-2016-4288High8.42017-01-06A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions th…
CVE-2020-14496High8.32022-05-19Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow…
CVE-2016-10846High8.12019-08-01cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
CVE-2017-2590High8.12018-07-27A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs…
CVE-2014-1632High8.12018-01-31htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
CVE-2026-19191High7.82026-08-07A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\D…
All CVEs classified under CWE-275 — newest first (page 1 of 2)
CVESeverityScorePublishedSummary
CVE-2026-19376High7.32026-08-10A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the co…
CVE-2026-19191High7.82026-08-07A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\D…
CVE-2026-19190High7.82026-08-07A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scan…
CVE-2026-12201Medium5.32026-06-15A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This mani…
CVE-2026-41976Medium6.62026-06-09Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-41978Medium4.42026-06-09Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-41969Medium6.22026-05-15Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-28553Medium6.92026-04-13Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidential…
CVE-2025-58288Medium5.52025-10-11Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
CVE-2025-58287High7.82025-10-11Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-10941High7.82025-09-25A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0…
CVE-2025-8797Medium6.32025-08-10A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStora…
CVE-2025-54624Medium5.72025-08-06Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-54618Medium5.72025-08-06Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-53168Medium5.72025-07-07Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may a…
CVE-2025-6765Medium6.32025-06-27A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/…
CVE-2024-13189High7.32025-01-08A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo…
CVE-2024-11486Medium4.32024-11-20A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor…
CVE-2024-11485Medium6.32024-11-20A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi…
CVE-2024-3118Medium6.32024-03-31A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attac…
CVE-2023-6762Medium5.42023-12-13A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ o…
CVE-2023-6302Medium4.72023-11-27A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the…
CVE-2023-5263Medium6.32023-09-29A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the compone…
CVE-2023-39399Critical9.12023-08-13Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho…
CVE-2023-39398Critical9.12023-08-13Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho…
CVE-2023-3759Medium6.32023-07-19A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issu…
CVE-2023-37238Medium5.32023-07-06Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulner…
CVE-2022-22251High7.82022-10-18On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip…
CVE-2022-25153High7.82022-06-09The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malici…
CVE-2020-14496High8.32022-05-19Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow…
CVE-2022-0343Low3.32022-03-29A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the…
CVE-2022-0742Critical9.12022-03-18Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or…
CVE-2021-22571Medium5.52022-03-18A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery…
CVE-2021-32006Medium5.02022-03-10This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea Gate…
CVE-2021-22566Critical9.82022-01-18An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T…
CVE-2022-22988High7.72022-01-13File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent…
CVE-2021-1437High7.52021-03-24A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain con…
CVE-2020-6022Medium5.52020-10-27Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.
CVE-2020-3152Medium6.72020-08-26A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary c…
CVE-2014-1422Medium5.02020-07-22In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will…
CVE-2020-8471High7.82020-04-29For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI…
CVE-2020-8474High7.82020-04-22Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, all…
CVE-2019-15962Medium4.42019-10-16A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root…
CVE-2019-2177High8.82019-09-05In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could le…
CVE-2019-12622Medium5.52019-08-21A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vul…
CVE-2019-11146High7.82019-08-19Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege…
CVE-2019-11145High7.82019-08-19Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege…
CVE-2016-10796Low3.32019-08-06cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
CVE-2017-18427Low3.32019-08-02In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
CVE-2017-18425Low2.52019-08-02In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
CVE-2017-18422Low3.32019-08-02In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
CVE-2017-18397Low3.32019-08-02cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
CVE-2017-18390High7.82019-08-02cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
CVE-2016-10818Medium6.52019-08-01cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
CVE-2016-10846High8.12019-08-01cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
CVE-2017-9327Medium6.52019-07-03Secret data of processes managed by CM is not secured by file permissions.
CVE-2017-17060Critical9.82019-05-23OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVE-2019-1618High7.82019-03-11A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to…
CVE-2018-0449Medium4.22019-01-10A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local…
CVE-2017-1418Medium4.02018-11-26IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain…
CVE-2018-15379Critical9.82018-10-05A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote…
CVE-2016-7066High7.82018-09-11It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to con…
CVE-2014-6047Medium5.32018-08-28phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment…
CVE-2017-1396Medium4.22018-08-06IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resourc…
CVE-2017-2590High8.12018-07-27A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs…
CVE-2018-0392Medium5.52018-07-18A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due t…
CVE-2016-9061High7.52018-06-11A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox…
CVE-2016-5299High7.52018-06-11A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: Th…
CVE-2013-3703High8.82018-06-08The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove us…
CVE-2012-5628Medium4.42018-05-04gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service by removing journa…
CVE-2013-4201Medium4.32018-05-01Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions.
CVE-2013-4040Medium5.52018-05-01IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (755) for unspecified…
CVE-2016-8732High7.82018-04-24Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communica…
CVE-2017-5809Medium5.52018-02-15A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
CVE-2016-8520High8.82018-02-15HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated…
CVE-2014-1632High8.12018-01-31htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
CVE-2014-1631High7.52018-01-31Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
CVE-2017-16887Critical9.82018-01-12The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t…
CVE-2015-7889Medium5.52017-12-28The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent…
CVE-2017-17876High7.52017-12-27Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in…
CVE-2017-11463High8.82017-12-11In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/upd…
CVE-2017-8153High7.12017-11-22Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into i…
CVE-2017-2694Low3.32017-11-22The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An…
CVE-2017-7145Medium5.32017-10-23An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandl…
CVE-2017-7144Medium4.32017-10-23An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "WebKit" component. It allow…
CVE-2017-7088Medium5.92017-10-23An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attacker…
CVE-2016-4924High8.42017-10-13An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE image…
CVE-2015-7842High7.12017-10-10Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software be…
CVE-2015-8300High7.82017-08-28Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," wh…
CVE-2015-5153High8.82017-08-18Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an o…
CVE-2015-7781High7.52017-06-27ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
CVE-2016-4873Medium4.32017-04-17Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.
CVE-2015-8223Medium5.52017-04-13Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash)…
CVE-2017-0884Medium4.32017-04-05Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in…
CVE-2017-0883Medium6.42017-04-05Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing…
CVE-2016-9462Medium4.32017-03-28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne…
CVE-2016-9461Medium4.32017-03-28Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was…
CVE-2016-2406Medium4.32017-03-20The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive i…
CVE-2017-6513Critical9.92017-03-11The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to con…
CVE-2016-7553Low3.32017-02-27The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local use…