CWE-281 · Improper Preservation of Permissions (page 4)
Page 4 of 4 — CVEs classified under CWE-281, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13668 | High | 7.4 | 2019-11-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2019-16539 | Medium | 6.5 | 2019-11-21 | A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles. |
CVE-2019-14226 | High | 8.1 | 2019-10-14 | OX App Suite through 7.10.2 has Insecure Permissions. |
CVE-2019-0073 | Medium | 6.6 | 2019-10-09 | The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user… |
CVE-2019-14956 | Medium | 4.3 | 2019-10-02 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. |
CVE-2019-11748 | Medium | 6.5 | 2019-09-27 | WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of… |
CVE-2019-6791 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Contr… |
CVE-2019-6995 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It h… |
CVE-2018-12989 | Medium | 6.7 | 2018-08-03 | The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Ex… |
CVE-2018-3762 | Medium | 4.3 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for… |
CVE-2018-5163 | High | 8.1 | 2018-06-11 | If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources st… |
CVE-2018-4115 | Critical | 9.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2017-8593 | High | 7.0 | 2017-08-08 | Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8590 | High | 8.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8589 | Critical | 9.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8581 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8580 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8578 | High | 7.8 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8577 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8574 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in… |
CVE-2017-8573 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8563 | High | 8.1 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8562 | High | 7.0 | 2017-07-11 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of pri… |
CVE-2017-8561 | High | 7.0 | 2017-07-11 | Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows… |
CVE-2017-8556 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8467 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 160… |
CVE-2017-8579 | High | 7.0 | 2017-06-29 | The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel… |
CVE-2017-8552 | High | 7.8 | 2017-06-15 | A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1… |
CVE-2017-8543 | Critical | 9.8 | 2017-06-15 | Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1… |
CVE-2017-8494 | High | 7.3 | 2017-06-15 | Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a locally-authenticated attacker to run a specially crafted application on a tar… |
CVE-2017-8468 | High | 7.8 | 2017-06-15 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run proce… |
CVE-2017-8466 | High | 7.8 | 2017-06-15 | Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation… |
CVE-2017-8465 | High | 7.8 | 2017-06-15 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run proce… |
CVE-2017-5033 | Medium | 4.3 | 2017-04-24 | Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local… |
CVE-2013-6335 | | 2014-08-26 | The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1… | |
CVE-2005-1920 | High | 7.5 | 2005-07-26 | The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original… |
CVE-2002-2323 | High | 7.5 | 2002-12-31 | Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored fro… |
CVE-2001-1515 | High | 7.5 | 2001-12-31 | Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which… |
CVE-2001-0195 | High | 7.8 | 2001-03-26 | sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to gain privileges via pas… |