Weakness (CWE)
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Source: MITRE CWE-281
95 results · Clear filters · Feed
-
High 7.7
The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.…
-
High 7.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be…
-
High 7.8
This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in Garage…
-
High 7.5
In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries…
-
High 7.8
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may …
-
High 8.4
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be ab…
-
High 8.8
An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.
-
High 8.8
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node v…
-
High 7.1
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an atta…
-
High 7.1
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an atta…
-
High 7.5
The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no per…
-
High 8.4CVE-2024-44193 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local atta…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera exten…
-
High 8.8
Improper Preservation of Permissions in xxl-job
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
-
High 7.2
Zscaler bypass with administrative privileges on Windows
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
-
High 7.1
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macO…
-
High 7.7
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS …
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ve…
-
High 7.7
This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sono…
-
High 8.4
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS…
-
High 8.4
An input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, m…
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify pr…
-
High 7.1
Permission and Access Control Vulnerability in ZTE H388X
There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific o…
-
High 7.8
Privilege Escalation
When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secur…
-
High 7.8
When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.…
-
High 8.1
Apache Airflow: Ignored Airflow Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airf…
-
High 7.6
Missing permission checks on Hazelcast client protocol
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
-
High 7.5
Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerabi…
-
High 8.4
Hiview has an improper preservation of permissions vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.
-
High 8.8
Disabled permissions can be granted by Jenkins SSH2 Easy Plugin
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitle…
-
High 7.1
Arbitrary File Overwrite using less command
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
-
High 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a f…
-
High 8.2
A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/…
-
High 7.5
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability …
-
High 7.5
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to…
-
High 7.8
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memo…
-
High 7.5
An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attack…
-
High 7.8
NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorize…
-
High 8.8
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or…