Skip to content
OpenAdvisories

Weakness (CWE)

CWE-281: Improper Preservation of Permissions

Base Draft

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Source: MITRE CWE-281

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.1
    CVE-2025-55130 Public exploit

    A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • High 7.5
    CVE-2024-57698 Public exploit

    An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes wit…

  • High 7.8
    CVE-2025-30456 Public exploit

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS iOS and iPadOS macOS iOS
  • Medium 5.0
    CVE-2025-22620 Public exploit

    gix-worktree-state nonexclusive checkout sets executable files world-writable

    gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permis…

    GitoxideLabs gitoxide gix-worktree-state rust-gix-worktree-state Debian crates.io
  • Critical 9.1
    CVE-2024-54879 Public exploit

    SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user …

  • Critical 9.1
    CVE-2024-54880 Public exploit

    SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user …

  • High 8.4
    CVE-2024-44193 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local atta…

    Apple iTunes for Windows Windows
  • Critical 9.1
    CVE-2023-34034 Public exploit

    Access Control Bypass in Spring Security

    Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

    org.springframework.security:spring-security-config Maven
  • High 8.8
    CVE-2022-38577 Public exploit

    ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability …

  • High 8.8
    CVE-2022-1227 Public exploit

    Podman publishes a malicious image to public registries

    A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…

    podman github.com/containers/podman/v3 libpod golang-github-containers-psgo Debian Ubuntu Alpine Go
  • High 8.8
    CVE-2021-45008 Public exploit

    Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to ad…

  • Medium 6.3
    CVE-2021-41091 Public exploit

    Insufficiently restricted permissions on data directory in Docker Engine

    Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing …

    moby moby docker.io docker.io Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2017-8543 Exploited Public exploit EPSS 74%

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 200…

    Microsoft Microsoft Windows Windows
    KEV May 24, 2022