CVE-2026-19376 | High | 7.3 | 2026-08-10 | A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the co… |
CVE-2026-19191 | High | 7.8 | 2026-08-07 | A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\D… |
CVE-2026-19190 | High | 7.8 | 2026-08-07 | A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scan… |
CVE-2026-12201 | Medium | 5.3 | 2026-06-15 | A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This mani… |
CVE-2026-41976 | Medium | 6.6 | 2026-06-09 | Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41978 | Medium | 4.4 | 2026-06-09 | Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41969 | Medium | 6.2 | 2026-05-15 | Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-28553 | Medium | 6.9 | 2026-04-13 | Vulnerability of improper permission control in the theme setting module.
Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2025-58288 | Medium | 5.5 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58287 | High | 7.8 | 2025-10-11 | Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-10941 | High | 7.8 | 2025-09-25 | A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0… |
CVE-2025-8797 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStora… |
CVE-2025-54624 | Medium | 5.7 | 2025-08-06 | Unexpected injection event vulnerability in the multimodalinput module.
Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54618 | Medium | 5.7 | 2025-08-06 | Permission control vulnerability in the distributed clipboard module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-53168 | Medium | 5.7 | 2025-07-07 | Vulnerability of bypassing the process to start SA and use related functions on distributed cameras
Impact: Successful exploitation of this vulnerability may a… |
CVE-2025-6765 | Medium | 6.3 | 2025-06-27 | A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/… |
CVE-2024-13189 | High | 7.3 | 2025-01-08 | A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo… |
CVE-2024-11486 | Medium | 4.3 | 2024-11-20 | A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor… |
CVE-2024-11485 | Medium | 6.3 | 2024-11-20 | A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-3118 | Medium | 6.3 | 2024-03-31 | A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attac… |
CVE-2023-6762 | Medium | 5.4 | 2023-12-13 | A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ o… |
CVE-2023-6302 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the… |
CVE-2023-5263 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the compone… |
CVE-2023-39399 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-39398 | Critical | 9.1 | 2023-08-13 | Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written witho… |
CVE-2023-3759 | Medium | 6.3 | 2023-07-19 | A vulnerability, which was classified as critical, was found in Intergard SGS 8.7.0. Affected is an unknown function. The manipulation leads to permission issu… |
CVE-2023-37238 | Medium | 5.3 | 2023-07-06 | Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulner… |
CVE-2022-22251 | High | 7.8 | 2022-10-18 | On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip… |
CVE-2022-25153 | High | 7.8 | 2022-06-09 | The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malici… |
CVE-2020-14496 | High | 8.3 | 2022-05-19 | Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow… |
CVE-2022-0343 | Low | 3.3 | 2022-03-29 | A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the… |
CVE-2022-0742 | Critical | 9.1 | 2022-03-18 | Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or… |
CVE-2021-22571 | Medium | 5.5 | 2022-03-18 | A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery… |
CVE-2021-32006 | Medium | 5.0 | 2022-03-10 | This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea Gate… |
CVE-2021-22566 | Critical | 9.8 | 2022-01-18 | An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. T… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |
CVE-2021-1437 | High | 7.5 | 2021-03-24 | A vulnerability in the FlexConnect Upgrade feature of Cisco Aironet Series Access Points Software could allow an unauthenticated, remote attacker to obtain con… |
CVE-2020-6022 | Medium | 5.5 | 2020-10-27 | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. |
CVE-2020-3152 | Medium | 6.7 | 2020-08-26 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary c… |
CVE-2014-1422 | Medium | 5.0 | 2020-07-22 | In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will… |
CVE-2020-8471 | High | 7.8 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8474 | High | 7.8 | 2020-04-22 | Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, all… |
CVE-2019-15962 | Medium | 4.4 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root… |
CVE-2019-2177 | High | 8.8 | 2019-09-05 | In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could le… |
CVE-2019-12622 | Medium | 5.5 | 2019-08-21 | A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vul… |
CVE-2019-11146 | High | 7.8 | 2019-08-19 | Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2019-11145 | High | 7.8 | 2019-08-19 | Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2016-10796 | Low | 3.3 | 2019-08-06 | cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130). |
CVE-2017-18427 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). |
CVE-2017-18425 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280). |
CVE-2017-18422 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). |
CVE-2017-18397 | Low | 3.3 | 2019-08-02 | cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330). |
CVE-2017-18390 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). |
CVE-2016-10818 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). |
CVE-2016-10846 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). |
CVE-2017-9327 | Medium | 6.5 | 2019-07-03 | Secret data of processes managed by CM is not secured by file permissions. |
CVE-2017-17060 | Critical | 9.8 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. |
CVE-2019-1618 | High | 7.8 | 2019-03-11 | A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to… |
CVE-2018-0449 | Medium | 4.2 | 2019-01-10 | A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local… |
CVE-2017-1418 | Medium | 4.0 | 2018-11-26 | IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain… |
CVE-2018-15379 | Critical | 9.8 | 2018-10-05 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote… |
CVE-2016-7066 | High | 7.8 | 2018-09-11 | It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to con… |
CVE-2014-6047 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment… |
CVE-2017-1396 | Medium | 4.2 | 2018-08-06 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resourc… |
CVE-2017-2590 | High | 8.1 | 2018-07-27 | A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs… |
CVE-2018-0392 | Medium | 5.5 | 2018-07-18 | A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due t… |
CVE-2016-9061 | High | 7.5 | 2018-06-11 | A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox… |
CVE-2016-5299 | High | 7.5 | 2018-06-11 | A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: Th… |
CVE-2013-3703 | High | 8.8 | 2018-06-08 | The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove us… |
CVE-2012-5628 | Medium | 4.4 | 2018-05-04 | gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service by removing journa… |
CVE-2013-4201 | Medium | 4.3 | 2018-05-01 | Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions. |
CVE-2013-4040 | Medium | 5.5 | 2018-05-01 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (755) for unspecified… |
CVE-2016-8732 | High | 7.8 | 2018-04-24 | Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communica… |
CVE-2017-5809 | Medium | 5.5 | 2018-02-15 | A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found. |
CVE-2016-8520 | High | 8.8 | 2018-02-15 | HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated… |
CVE-2014-1632 | High | 8.1 | 2018-01-31 | htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. |
CVE-2014-1631 | High | 7.5 | 2018-01-31 | Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php. |
CVE-2017-16887 | Critical | 9.8 | 2018-01-12 | The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t… |
CVE-2015-7889 | Medium | 5.5 | 2017-12-28 | The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent… |
CVE-2017-17876 | High | 7.5 | 2017-12-27 | Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in… |
CVE-2017-11463 | High | 8.8 | 2017-12-11 | In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/upd… |
CVE-2017-8153 | High | 7.1 | 2017-11-22 | Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into i… |
CVE-2017-2694 | Low | 3.3 | 2017-11-22 | The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An… |
CVE-2017-7145 | Medium | 5.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandl… |
CVE-2017-7144 | Medium | 4.3 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "WebKit" component. It allow… |
CVE-2017-7088 | Medium | 5.9 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attacker… |
CVE-2016-4924 | High | 8.4 | 2017-10-13 | An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE image… |
CVE-2015-7842 | High | 7.1 | 2017-10-10 | Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software be… |
CVE-2015-8300 | High | 7.8 | 2017-08-28 | Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," wh… |
CVE-2015-5153 | High | 8.8 | 2017-08-18 | Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an o… |
CVE-2015-7781 | High | 7.5 | 2017-06-27 | ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. |
CVE-2016-4873 | Medium | 4.3 | 2017-04-17 | Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function. |
CVE-2015-8223 | Medium | 5.5 | 2017-04-13 | Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash)… |
CVE-2017-0884 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in… |
CVE-2017-0883 | Medium | 6.4 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing… |
CVE-2016-9462 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne… |
CVE-2016-9461 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was… |
CVE-2016-2406 | Medium | 4.3 | 2017-03-20 | The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive i… |
CVE-2017-6513 | Critical | 9.9 | 2017-03-11 | The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to con… |
CVE-2016-7553 | Low | 3.3 | 2017-02-27 | The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local use… |