CWE-281 · Improper Preservation of Permissions (page 4)
Page 4 of 4 — CVEs classified under CWE-281, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7063 | Medium | 5.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the file… |
CVE-2020-8633 | Medium | 5.3 | 2020-02-18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed moun… |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2019-15621 | Medium | 6.5 | 2020-02-04 | Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a shar… |
CVE-2019-13727 | High | 8.8 | 2019-12-10 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2019-19620 | Low | 3.3 | 2019-12-06 | In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions f… |
CVE-2019-18458 | Low | 2.7 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4). |
CVE-2019-18457 | High | 8.8 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions. |
CVE-2019-13682 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via… |
CVE-2019-13668 | High | 7.4 | 2019-11-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2019-16539 | Medium | 6.5 | 2019-11-21 | A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles. |
CVE-2019-14226 | High | 8.1 | 2019-10-14 | OX App Suite through 7.10.2 has Insecure Permissions. |
CVE-2019-0073 | Medium | 6.6 | 2019-10-09 | The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user… |
CVE-2019-14956 | Medium | 4.3 | 2019-10-02 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. |
CVE-2019-11748 | Medium | 6.5 | 2019-09-27 | WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of… |
CVE-2019-6791 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Contr… |
CVE-2019-6995 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It h… |
CVE-2018-12989 | Medium | 6.7 | 2018-08-03 | The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Ex… |
CVE-2018-3762 | Medium | 4.3 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for… |
CVE-2018-5163 | High | 8.1 | 2018-06-11 | If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources st… |
CVE-2018-4115 | Critical | 9.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2017-8593 | High | 7.0 | 2017-08-08 | Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8590 | High | 8.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8589 | Critical | 9.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8581 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8580 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8578 | High | 7.8 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8577 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8574 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in… |
CVE-2017-8573 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8563 | High | 8.1 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8562 | High | 7.0 | 2017-07-11 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of pri… |
CVE-2017-8561 | High | 7.0 | 2017-07-11 | Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows… |
CVE-2017-8556 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8467 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 160… |
CVE-2017-8579 | High | 7.0 | 2017-06-29 | The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel… |
CVE-2017-8552 | High | 7.8 | 2017-06-15 | A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1… |
CVE-2017-8543 | Critical | 9.8 | 2017-06-15 | Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1… |
CVE-2017-8494 | High | 7.3 | 2017-06-15 | Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a locally-authenticated attacker to run a specially crafted application on a tar… |
CVE-2017-8468 | High | 7.8 | 2017-06-15 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run proce… |
CVE-2017-8466 | High | 7.8 | 2017-06-15 | Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation… |
CVE-2017-8465 | High | 7.8 | 2017-06-15 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run proce… |
CVE-2017-5033 | Medium | 4.3 | 2017-04-24 | Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local… |
CVE-2013-6335 | | 2014-08-26 | The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1… | |
CVE-2005-1920 | High | 7.5 | 2005-07-26 | The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original… |
CVE-2002-2323 | High | 7.5 | 2002-12-31 | Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored fro… |
CVE-2001-1515 | High | 7.5 | 2001-12-31 | Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which… |
CVE-2001-0195 | High | 7.8 | 2001-03-26 | sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to gain privileges via pas… |