CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- trellix agentA vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local...8.2 High
- nextcloud, kiteworks security-advisories +1 moreApp lockout in nextcloud Android app can be bypassed via thirdparty apps4.4 Medium
- nextcloud, kiteworks security-advisories +1 moreApp pin of the iOS app can be bypassed in Nextcloud iOS4.4 Medium
- linuxfoundation runcrootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc5.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreDelete permissions are not saved when creating public share in Nextcloud server3.5 Low
- linuxfoundation runcAppArmor bypass with symlinked /proc in runc6.1 Medium
- jenkins role-based authorization strategy, jenkins project role-based authorization strategy plugin +1 moreJenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled9.8 Critical
- samsung calendarImproper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3...4.0 Medium
- mozilla firefoxIf temporary "one-time" permissions, such as the ability to use the Camera, were granted to a...8.8 High
- vantage6Improper Preservation of Permissions in vantage66.3 Medium
- minioAllowed DELETE on resources on object locked buckets under Governance mode in Minio6.5 Medium
- huawei emui, harmonyos +1 moreThe bundle management module lacks permission verification in some APIs. Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe SystemUI has a vulnerability in permission management. Successful exploitation of this...5.3 Medium
- huawei emui, harmonyos +1 moreThe IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this...7.5 High
- carel pcoweb card bios, pcoweb card boot, pcoweb card web +2 moreAn issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web...7.5 High
- nvidia gpu display driver, cloud gaming, vgpu software (guest driver) - linux, nvidia cloud gaming (guest driver) +1 more +3 moreNVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to co…7.8 High
- protocol gossipsubGossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not...5.3 Medium
- openbmb xagent, trellix endpoint security agent +1 moreTrellix xAgent permission bypass vulnerability5.5 Medium
- bigbluebuttonBigBlueButton contains Improper Preservation of Permissions for whiteboard2.7 Low
- alistgo alistAList vulnerable to Improper Preservation of Permissions8.8 High
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreAn incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially...7.8 High
- intel nuc7i3dnbe firmware, nuc7i3dnhe firmware, nuc7i3dnhnc firmware +8 more +10 moreImproper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and...6.7 Medium
- hitachi vantara pentaho, hitachi vantara pentaho business analytics server +1 morePentaho Business Analytics Server - Exposure of Information Through Directory Listing5.0 Medium
- opendev sushy-tools, virtualbmc, fedoraproject fedora +2 moreOpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions5.5 Medium
- verint desktop and process analyticsThe MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate...7.8 High
- relatedcode messengerRelatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access...4.3 Medium
- red hat business-central, redhat decision manager, process automation +2 moreA flaw was found in the RHDM, where an authenticated attacker can change their assigned role in...8.8 High
github.com/treeverse/lakefsGolakeFS vulnerable to authenticated users deleting files they are not authorized to deleteNo score- grafanaGrafana folders admin only permission privilege escalation7.6 High
- amazon fhir-works-on-aws-authz-smartSecurity issue in fhir-works-on-aws-authz-smart6.5 Medium
- processmakerProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile...8.8 High
- shopwareAcess control list bypassed via crafted specific URLs6.3 Medium
- [unknown] satelliteA flaw was found in satellite. When giving granular permission related to the organization, other...8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreA cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions ...8.8 High
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an...3.3 Low
- gog galaxyAn exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to...7.8 High
- debian schroot, linux +1 morestricter rules on chroot names4.3 Medium
- nvidia gpu display driver, geforce, workstation, compute +1 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration...7.8 High
- ibm spectrum protect plus, spectrum protect plus container backup and restore +1 moreIBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes...6.0 Medium
- metamaskMetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because...5.9 Medium
- discourseInvites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse5.7 Medium
- qualcomm, inc. snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm apq8053 firmware, aqt1000 firmware +59 more +61 moreImproper validation of permissions for third party application accessing Telephony service API...6.2 Medium
- huawei emui, harmonyos, magic ui +2 moreThe communication module has a vulnerability of improper permission preservation. Successful...5.5 Medium
- eginnovations eg agent, eg manager, eg rum collectors +1 more +3 moreeG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.7.8 High
ezsystems/ezplatform-kernelPackagistObject state limitation has no effectNo score- podman project podman, fedoraproject fedora, psgo project psgo +13 more +15 morePodman publishes a malicious image to public registries8.8 High
ibexa/corePackagistObject state limitation has no effectNo score- ibexa kernel, digital experience platform, ez platform kernel +2 more +4 moreObject state limitation has no effect9.8 Critical
- redhat apicastA flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified...7.5 High
- helpsystems titus data classificationThe Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the...5.5 Medium
- Show moreLoading…