CWE-281 · Improper Preservation of Permissions (page 3)
Page 3 of 4 — CVEs classified under CWE-281, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41963 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but… |
CVE-2022-31608 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact pro… |
CVE-2022-26024 | Medium | 6.7 | 2022-11-11 | Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated… |
CVE-2021-45446 | Medium | 5.0 | 2022-11-02 | A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the childr… |
CVE-2022-44020 | Medium | 5.5 | 2022-10-30 | An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages remove… |
CVE-2020-12744 | High | 7.8 | 2022-10-20 | The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair. |
CVE-2022-41708 | Medium | 4.3 | 2022-10-19 | Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. Th… |
CVE-2019-14841 | High | 8.8 | 2022-10-17 | A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin… |
CVE-2022-36062 | High | 7.6 | 2022-09-22 | Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation… |
CVE-2022-38577 | High | 8.8 | 2022-09-19 | ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal user… |
CVE-2022-36102 | Medium | 6.3 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed… |
CVE-2022-2787 | Medium | 4.3 | 2022-08-27 | Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a s… |
CVE-2021-3414 | High | 8.1 | 2022-08-26 | A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organiza… |
CVE-2022-31237 | Low | 3.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low p… |
CVE-2022-31262 | High | 7.8 | 2022-08-17 | An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %Progra… |
CVE-2022-22472 | High | 8.8 | 2022-06-30 | IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow… |
CVE-2022-32969 | Medium | 5.9 | 2022-06-29 | MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and… |
CVE-2022-31096 | Medium | 5.7 | 2022-06-27 | Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the in… |
CVE-2021-35079 | Medium | 6.2 | 2022-06-14 | Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdr… |
CVE-2022-31755 | Medium | 5.5 | 2022-06-13 | The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-29594 | High | 7.8 | 2022-06-02 | eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM. |
CVE-2022-1227 | High | 8.8 | 2022-04-29 | A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded… |
CVE-2021-3523 | High | 7.5 | 2022-04-27 | A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass s… |
CVE-2021-43708 | Medium | 5.5 | 2022-04-21 | The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel's safe mode. |
CVE-2022-24428 | Medium | 6.3 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem use… |
CVE-2021-3847 | High | 7.8 | 2022-04-01 | An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a c… |
CVE-2022-0330 | High | 7.8 | 2022-03-25 | A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw… |
CVE-2022-22650 | Medium | 5.5 | 2022-03-18 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A plug-in m… |
CVE-2021-39704 | High | 7.8 | 2022-03-16 | In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a perm… |
CVE-2021-39695 | High | 7.8 | 2022-03-16 | In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil… |
CVE-2022-24618 | High | 7.8 | 2022-03-10 | Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privile… |
CVE-2021-45008 | High | 8.8 | 2022-02-21 | Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that… |
CVE-2022-21203 | High | 7.8 | 2022-02-09 | Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenticated user to poten… |
CVE-2021-43816 | High | 8.0 | 2022-01-05 | containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5… |
CVE-2021-30279 | High | 7.8 | 2022-01-03 | Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity… |
CVE-2021-0953 | High | 7.8 | 2021-12-15 | In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe… |
CVE-2021-0927 | High | 7.8 | 2021-12-15 | In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. This could lead to local esca… |
CVE-2021-0704 | Medium | 5.5 | 2021-12-15 | In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounts from the device… |
CVE-2021-37044 | High | 7.5 | 2021-12-08 | There is a Permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. |
CVE-2021-37086 | High | 8.6 | 2021-12-07 | There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which ca… |
CVE-2021-37056 | Medium | 5.3 | 2021-12-07 | There is an Improper permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to obtain certain d… |
CVE-2021-37006 | High | 7.5 | 2021-11-23 | There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality… |
CVE-2021-39897 | Low | 2.6 | 2021-11-05 | Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have ac… |
CVE-2021-30827 | High | 7.8 | 2021-10-19 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in Security Update 2021-005 Catalina, macOS Big… |
CVE-2021-41091 | Medium | 6.3 | 2021-10-04 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typical… |
CVE-2021-41089 | Low | 2.8 | 2021-10-04 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files us… |
CVE-2021-30912 | Medium | 5.5 | 2021-08-24 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1… |
CVE-2021-38553 | Medium | 4.4 | 2021-08-13 | HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessivel… |
CVE-2021-29971 | Critical | 9.8 | 2021-08-05 | If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted… |
CVE-2021-32465 | High | 8.8 | 2021-08-04 | An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an… |
CVE-2020-15496 | High | 7.8 | 2021-07-15 | Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions. |
CVE-2021-22382 | Medium | 6.5 | 2021-06-22 | Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to inst… |
CVE-2021-21735 | Medium | 6.5 | 2021-06-10 | A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnera… |
CVE-2021-0074 | High | 7.8 | 2021-06-09 | Improper permissions in the installer for the Intel(R) Computing Improvement Program software before version 2.4.5982 may allow an authenticated user to potent… |
CVE-2020-27383 | High | 7.8 | 2021-06-09 | Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the exis… |
CVE-2021-3495 | High | 8.8 | 2021-06-01 | An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level o… |
CVE-2021-22137 | Medium | 5.3 | 2021-05-13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not pr… |
CVE-2021-30482 | High | 7.5 | 2021-05-11 | In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly |
CVE-2020-18890 | Critical | 9.8 | 2021-05-06 | Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.ph… |
CVE-2021-3418 | Medium | 6.4 | 2021-03-15 | If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kern… |
CVE-2021-21379 | High | 7.7 | 2021-03-12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimac… |
CVE-2021-20263 | Low | 3.3 | 2021-03-09 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the gue… |
CVE-2021-23963 | Medium | 4.3 | 2021-02-26 | When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control ove… |
CVE-2020-26246 | High | 7.7 | 2020-12-03 | Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the ap… |
CVE-2020-5796 | High | 7.8 | 2020-11-13 | Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low… |
CVE-2020-12353 | Medium | 6.5 | 2020-11-12 | Improper permissions in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable denial of service v… |
CVE-2020-12345 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable e… |
CVE-2020-12335 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Processor Identification Utility before version 6.4.0603 may allow an authenticated user to potentially… |
CVE-2020-12334 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Advisor tools before version 2020 Update 2 may allow an authenticated user to potentially enable escalat… |
CVE-2020-12332 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) HID Event Filter Driver, all versions, may allow an authenticated user to potentially enable escalation… |
CVE-2020-12330 | High | 7.8 | 2020-11-12 | Improper permissions in the installer for the Intel(R) Falcon 8+ UAS AscTec Thermal Viewer, all versions, may allow an authenticated user to potentially enable… |
CVE-2020-16910 | Medium | 6.2 | 2020-10-16 | <p>A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create fil… |
CVE-2020-8182 | High | 8.0 | 2020-10-05 | Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. |
CVE-2020-6564 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a… |
CVE-2020-0405 | High | 7.8 | 2020-09-18 | In NetworkStackNotifier, there is a possible permissions bypass due to an unsafe implicit PendingIntent. This could lead to local escalation of privilege with… |
CVE-2020-13308 | Low | 2.7 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from ac… |
CVE-2019-0233 | High | 7.5 | 2020-09-14 | An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-8913 | High | 8.8 | 2020-08-12 | A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious… |
CVE-2020-15113 | Medium | 5.7 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically gener… |
CVE-2020-8190 | High | 7.5 | 2020-07-10 | Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege esca… |
CVE-2020-14958 | Medium | 6.5 | 2020-06-21 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. |
CVE-2019-20846 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage. |
CVE-2019-20843 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. |
CVE-2020-13763 | High | 7.5 | 2020-06-02 | In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users. |
CVE-2020-13230 | Medium | 4.3 | 2020-05-20 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). |
CVE-2020-2025 | High | 8.8 | 2020-05-19 | Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite t… |
CVE-2020-9781 | Medium | 5.3 | 2020-04-01 | The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website perm… |
CVE-2020-10083 | Critical | 9.1 | 2020-03-13 | GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied. |
CVE-2020-8634 | High | 7.8 | 2020-03-07 | Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files… |
CVE-2020-9442 | High | 7.8 | 2020-02-28 | OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privi… |
CVE-2020-7063 | Medium | 5.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the file… |
CVE-2020-8633 | Medium | 5.3 | 2020-02-18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed moun… |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2019-15621 | Medium | 6.5 | 2020-02-04 | Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a shar… |
CVE-2019-13727 | High | 8.8 | 2019-12-10 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2019-19620 | Low | 3.3 | 2019-12-06 | In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions f… |
CVE-2019-18458 | Low | 2.7 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4). |
CVE-2019-18457 | High | 8.8 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions. |
CVE-2019-13682 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via… |