CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- reviewxWordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability4.3 Medium
- wagtailPermission check bypass when editing a model with per-field restrictions in wagtail2.7 Low
- macpaw xadmasterXADMaster may not apply quarantine attribute correctly to extracted files5.5 Medium
- red hat build of quarkus, build of quarkus 3.2.11.final +1 moreQuarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service5.3 Medium
github.com/authelia/authelia/v4GoAuthelia's Group Changes may not have the expected results (YAML file backend)1.6 Low- hcltechsw hcl devops deploy, hcl launch, hcl software devops deploy / launch +2 moreHCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type4.4 Medium
- devolutions server, remote desktop manager +1 moreImproper permission handling in the vault offline cache feature in Devolutions Remote Desktop...4.3 Medium
- huawei emui, harmonyos +1 morePermission verification vulnerability in the system module. Impact: Successful exploitation of...6.5 Medium
- openatom openharmonyAudio has an improper preservation of permissions vulnerability3.3 Low
- apache airflowApache Airflow: Potentially harmful permission changing by log task handler5.3 Medium
- anopeAnope before 2.0.15 does not prevent resetting the password of a suspended account.5.3 Medium
- apache airflowApache Airflow: Ignored Airflow Permissions8.1 High
- jenkins bitbucket branch source, jenkins project bitbucket branch source plugin +1 moreJenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests6.3 Medium
- openatom openharmonyBackground task manager has an improper preservation of permissions vulnerability4.0 Medium
- couchbase serverAn issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL...5.4 Medium
- hazelcastMissing permission checks on Hazelcast client protocol7.6 High
- huawei emui, harmonyos +1 moreVulnerability of permission verification in the content sharing pop-up module.Successful...7.5 High
- lamassu bitcoin atm douro machines, douro firmware, douro ii firmware +2 morePrivilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines6.3 Medium
- nextcloud guests, kiteworks security-advisories +1 moreImproper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist5.4 Medium
- nextcloud guests, kiteworks security-advisories +1 moreAll users can reset the allowed apps list for Nextcloud Guest App users4.1 Medium
- kiteworks security-advisories, nextcloud zipper +1 morePermissions bypass in Nextcloud with the files zip app4.1 Medium
- libreoffice, debian linux, fedoraproject fedora +2 moreLink targets allow arbitrary script execution8.3 High
- gl-inet gl-ax1800 firmwareInsecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote...9.8 Critical
- m-files serverIncorrect calculation of effective permissions5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery9.1 Critical
- openatom openharmonyHiview has an improper preservation of permissions vulnerability8.4 High
- netskope, netskope client +1 moreLocal privilege escalation6.6 Medium
- dromara sa-tokenSaToken privilege escalation vulnerability9.8 Critical
- nxp uboot secondary program loader, u boot secondary program loader\/spl\/ boot secondary program loader\/spl\/ +1 moreA software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before...7.0 High
- amazon opensearch, embysupport security +1 moreOpenSearch Issue with tenant read-only permissions5.4 Medium
- samsung sassistantImproper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows...5.1 Medium
- apachefriends xampp, xampp apache distribution +1 moreThe installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory....6.7 Medium
- apache supersetApache Superset: Improper API permission for low privilege users5.4 Medium
- jenkins ssh2 easy, jenkins project ssh2 easy plugin +1 moreDisabled permissions can be granted by Jenkins SSH2 Easy Plugin8.8 High
- brocade fabric os, broadcom brocade fabric operating system +1 moreArbitrary File Overwrite using less command7.1 High
- qemu, fedora extra packages for enterprise linux, fedora +5 more +7 moreQemu: 9pfs: suid/sgid bits not dropped on file write3.3 Low
- spring security, vmware spring security +1 moreAccess Control Bypass in Spring Security9.1 Critical
- ibm security guardiumIBM Security Guardium privilege escalation8.4 High
- google androidIn multiple functions of OneTimePermissionUserManager.java, there is a possible one-time...5.5 Medium
- enalean tuleapUser access not updated with privilege change in Tuleap4.1 Medium
- proofpoint insider threat managementITM Windows Agent Insecure Filesystem Permissions5.5 Medium
- trend micro apex one, trend micro, inc. micro apex one +1 moreAn Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could...5.3 Medium
- lenovo fan power controller (fpc), nextscale n1200 enclosure firmware, system management module (smm) +7 more +9 moreA valid, authenticated user with limited privileges may be able to use specifically crafted web...5.4 Medium
- elenos etg150, etg150 firmware +1 moreImproper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM...8.8 High
- apple ipados, macos, watchos +2 more +4 moreThis issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5,...5.5 Medium
- apple ipados, macos, watchos +2 more +4 moreA privacy issue was addressed with improved private data redaction for log entries. This issue is...5.5 Medium
- apple macosA logic issue was addressed with improved state management. This issue is fixed in macOS Ventura...5.5 Medium
- supremainc biostar 2Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web...8.8 High
- thecontrolgroup voyagerRemote code execution in Voyager9.8 Critical
- liferay portalLiferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders...9.8 Critical
- Show moreLoading…