CWE-281 · Improper Preservation of Permissions (page 2)
Page 2 of 4 — CVEs classified under CWE-281, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52522 | | 2024-11-15 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --… | |
CVE-2024-36062 | Medium | 4.0 | 2024-11-07 | The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place… |
CVE-2024-10458 | High | 7.5 | 2024-10-29 | A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-44193 | High | 7.8 | 2024-10-02 | A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privil… |
CVE-2024-9333 | | 2024-10-02 | Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access… | |
CVE-2024-44188 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44149 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-40859 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data. |
CVE-2024-40831 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library. |
CVE-2024-40770 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted… |
CVE-2024-27858 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-27795 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet. |
CVE-2024-22121 | Medium | 6.1 | 2024-08-12 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
CVE-2024-22114 | Medium | 4.3 | 2024-08-12 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. |
CVE-2024-23464 | High | 7.2 | 2024-08-06 | In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2… |
CVE-2024-33892 | High | 7.5 | 2024-08-02 | Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informatio… |
CVE-2024-40828 | High | 7.8 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicious app may be abl… |
CVE-2024-40824 | Medium | 5.5 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An app… |
CVE-2024-40821 | High | 7.1 | 2024-07-29 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Thir… |
CVE-2024-40811 | Medium | 5.5 | 2024-07-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify protected parts of the file system. |
CVE-2024-40805 | High | 7.1 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An… |
CVE-2024-40800 | Medium | 5.5 | 2024-07-29 | An input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8… |
CVE-2024-27888 | Medium | 5.5 | 2024-07-29 | A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An app may be able to mod… |
CVE-2024-39902 | Medium | 4.8 | 2024-07-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Ente… |
CVE-2024-29080 | Medium | 6.5 | 2024-07-19 | Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driver which might allo… |
CVE-2024-2819 | Medium | 5.1 | 2024-07-02 | Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue aff… |
CVE-2024-36532 | Critical | 10.0 | 2024-06-21 | Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-38361 | Low | 3.7 | 2024-06-20 | Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion un… |
CVE-2023-25646 | High | 7.1 | 2024-06-20 | There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can u… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2024-3291 | High | 7.8 | 2024-05-17 | When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure per… |
CVE-2024-3289 | High | 7.8 | 2024-05-17 | When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for… |
CVE-2024-32020 | Low | 3.9 | 2024-05-14 | Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into… |
CVE-2024-4768 | Medium | 6.1 | 2024-05-14 | A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Fi… |
CVE-2024-33921 | Medium | 4.3 | 2024-05-03 | Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21. |
CVE-2024-32882 | Low | 2.7 | 2024-05-02 | Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.c… |
CVE-2024-22405 | Medium | 5.5 | 2024-04-30 | XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply qu… |
CVE-2024-1726 | Medium | 5.3 | 2024-04-25 | A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization… |
CVE-2024-23560 | Medium | 4.4 | 2024-04-15 | HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. |
CVE-2024-3545 | Medium | 4.3 | 2024-04-09 | Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2… |
CVE-2023-52542 | Medium | 6.5 | 2024-04-08 | Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-22177 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission. |
CVE-2024-29735 | Medium | 5.3 | 2024-03-26 | Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task han… |
CVE-2024-30187 | Medium | 5.3 | 2024-03-25 | Anope before 2.0.15 does not prevent resetting the password of a suspended account. |
CVE-2024-28746 | High | 8.1 | 2024-03-14 | Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variab… |
CVE-2024-28152 | Medium | 6.3 | 2024-03-06 | In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trus… |
CVE-2024-21816 | Medium | 4.0 | 2024-03-04 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions. |
CVE-2023-49932 | Medium | 5.4 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions. |
CVE-2023-52373 | High | 7.5 | 2024-02-18 | Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing. |
CVE-2024-0674 | Medium | 6.3 | 2024-01-30 | Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by mod… |
CVE-2024-22404 | Medium | 4.1 | 2024-01-18 | Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only"… |
CVE-2024-22402 | Medium | 5.4 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page… |
CVE-2024-22401 | Medium | 4.1 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of… |
CVE-2023-6186 | High | 8.3 | 2023-12-11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected ver… |
CVE-2023-47463 | Critical | 9.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the… |
CVE-2023-6239 | Medium | 5.4 | 2023-11-28 | Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven per… |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-43612 | High | 8.4 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. |
CVE-2023-4996 | Medium | 6.6 | 2023-11-06 | Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope c… |
CVE-2023-39902 | High | 7.0 | 2023-10-17 | A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain… |
CVE-2023-45807 | Medium | 5.4 | 2023-10-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implement… |
CVE-2023-30735 | Medium | 5.1 | 2023-10-04 | Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssistant. |
CVE-2022-47637 | Medium | 6.7 | 2023-09-12 | The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory. Common use cases execute files under C:\xampp with administrative… |
CVE-2023-41939 | High | 8.8 | 2023-09-06 | Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (ty… |
CVE-2023-31926 | High | 7.1 | 2023-08-02 | System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0. |
CVE-2023-1386 | Low | 3.3 | 2023-07-24 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, no… |
CVE-2023-34034 | Critical | 9.1 | 2023-07-19 | Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and t… |
CVE-2022-43910 | High | 8.4 | 2023-07-19 | IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls. IBM X-Force ID: 240908. |
CVE-2023-21249 | Medium | 5.5 | 2023-07-13 | In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a permissions bypass. This could lead to l… |
CVE-2023-35938 | Medium | 4.1 | 2023-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows re… |
CVE-2023-2818 | Medium | 5.5 | 2023-06-27 | An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions… |
CVE-2023-32552 | Medium | 5.3 | 2023-06-26 | An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to d… |
CVE-2023-2993 | Medium | 5.4 | 2023-06-26 | A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of comm… |
CVE-2023-34672 | High | 8.8 | 2023-06-23 | Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within t… |
CVE-2023-32400 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. Entitlements and privacy permi… |
CVE-2023-32388 | Medium | 5.5 | 2023-06-23 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 and iPad… |
CVE-2023-32355 | Medium | 5.5 | 2023-06-23 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may… |
CVE-2023-28161 | High | 8.8 | 2023-06-02 | If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in t… |
CVE-2023-31923 | High | 8.8 | 2023-05-22 | Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator"… |
CVE-2020-36070 | Critical | 9.8 | 2023-04-26 | Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media com… |
CVE-2021-33990 | Critical | 9.8 | 2023-04-16 | Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the… |
CVE-2023-0975 | High | 8.2 | 2023-04-03 | A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the… |
CVE-2023-28668 | Critical | 9.8 | 2023-04-02 | Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. |
CVE-2023-28647 | Medium | 4.4 | 2023-03-30 | Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access… |
CVE-2023-28646 | Medium | 4.4 | 2023-03-30 | Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has acc… |
CVE-2023-28642 | Medium | 6.1 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the c… |
CVE-2023-25809 | Medium | 5.0 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/… |
CVE-2023-25817 | Low | 3.5 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete… |
CVE-2023-21464 | Medium | 4.0 | 2023-03-16 | Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3.08.2000 in Android 12 allows local attacker to configure impr… |
CVE-2023-22738 | Medium | 6.3 | 2023-03-01 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is curren… |
CVE-2023-25812 | Medium | 6.5 | 2023-02-21 | Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Acc… |
CVE-2022-48301 | High | 7.5 | 2023-02-09 | The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that… |
CVE-2022-48296 | Medium | 5.3 | 2023-02-09 | The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious a… |
CVE-2022-48295 | High | 7.5 | 2023-02-09 | The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of… |
CVE-2022-4139 | High | 7.8 | 2023-01-27 | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw c… |
CVE-2020-18329 | High | 7.5 | 2023-01-26 | An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access… |
CVE-2022-42260 | High | 7.8 | 2022-12-30 | NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protec… |
CVE-2022-38473 | High | 8.8 | 2022-12-22 | A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affe… |
CVE-2022-47547 | Medium | 5.3 | 2022-12-19 | GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbe… |
CVE-2022-4326 | Medium | 5.5 | 2022-12-16 | Improper preservation of permissions vulnerability in Trellix Endpoint Agent (xAgent) prior to V35.31.22 on Windows allows a local user with administrator priv… |