CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- samsung exynos 1480, exynos 2400, samsung semiconductor exynos 1580 +3 more +5 more Improper permission handling during buffer operations allows untrusted applications to create... No score
- wso2 carbon scim 2.0 common component, carbon scim common component, identity server +2 more +4 more Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover 8.2 High
- freebsd Multiple jail filesystem root escapes 9.8 Critical
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 more NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an... 7.0 High
- nvidia geforce, rtx, quadro, nvs, tesla +2 more NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module... 7.8 High
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 more NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an... 7.8 High
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 more NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where... 7.8 High
- uutils coreutils uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid 7.3 High
- openfga OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that… 5.3 Medium
- gen digital avast free antivirus, avast one, avast premium security, avast ultimate, avast business security, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 more Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys 8.8 High
- hashicorp shared library Go-getter vulnerable to a privilege escalation issue in its archive decompression handling 6.7 Medium
- rclone rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination 7.1 High
- wso2 identity server, carbon identity api server secret management common, carbon identity api server secret management v1 +2 more Improper Access Control via Secret Type Management API in WSO2 Identity Server 3.8 Low
- gitea open source git server GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private 4.3 Medium
- xen oxenstored oxenstored keeps quota related use counts across domain destruction 9.4 Critical
- python, python software foundation cpython +1 more Tarfile.extract() doesn't fully respect filter parameter 2.0 Low
- suse rancher Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher 6.9 Medium
- bytecodealliance wasmtime Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination 6.5 Medium
- tomdever wpforo forum WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability 7.5 High
- synology surveillance station Improper preservation of permissions vulnerability in Archiving Push functionality in Synology... 2.7 Low
- nvidia geforce, gpu display driver, guest driver +2 more +4 more NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a... 7.8 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 more Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent 9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 more Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh 6.3 Medium
- laurent22 joplin Joplin Server delta API returns note content after share access is revoked 5.7 Medium
- openharmony filemanagement_storage_service has an improper preservation of permissions vulnerability 5.5 Medium
- mantisbt MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues 5.3 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 more Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations 6.3 Medium
- grokability snipe-it Snipe-IT: Privilege Escalation via API Permissions Assignment 8.7 High
- uutils coreutils uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems 3.4 Low
- uutils coreutils uutils coreutils mv Silent Ownership Loss in Cross-Device Operations 4.2 Medium
- uutils coreutils uutils coreutils cp Unexpected Privileged Executable Creation with -p 6.6 Medium
- uutils coreutils uutils coreutils mkfifo Unauthorized Permission Change on Existing Files 7.1 High
- openbsd openssh, red hat multicluster engine for kubernetes, openshift pipelines +29 more +31 more In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome... 7.5 High
- katacontainers kata containers, kata-containers, red hat confidential compute attestation +1 more +3 more Kata Container to Guest micro VM privilege escalation 9.4 Critical
- quickheal total security A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component... 7.8 High
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow... 7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 more Networkmanager: networkmanager file access 3.3 Low
- 3scale porta, red hat 3scale api management platform 2 +1 more 3scale-porta: readonly fields not validated server-side 7.5 High
- elastic kibana Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary... 7.0 High
- nagios log server Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation 8.7 High
- suse rancher Rancher user retains access to clusters despite Global Role removal 4.3 Medium
- pyload pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages 8.7 High
- salesforce omnistudio Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows... 5.3 Medium
- salesforce omnistudio Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows... 9.1 Critical
- salesforce omnistudio Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows... 7.5 High
- salesforce omnistudio Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows... 7.5 High
- salesforce omnistudio Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows... 7.5 High
- openatom openharmony Pasteboard has an improper preservation of permissions vulnerability 5.5 Medium
- openatom openharmony security_access_token has an improper preservation of permissions vulnerability 3.3 Low
- openatom openharmony security_access_token has an improper preservation of permissions vulnerability 3.3 Low
- Show olderLoading…