Weakness (CWE)
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Source: MITRE CWE-281
100 results · Clear filters · Feed
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 4.3
System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
-
Medium 6.1
Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
-
Medium 5.3
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1…
-
Medium 4.8
Tuleap's recursive permissions to document manager folder are not properly applied
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this fol…
-
Medium 6.5
Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application E…
-
Medium 5.1
File Permission Vulnerability in Hitachi Ops Center Common Services
Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue affects Hitachi Ops Center Common Services: before 11.0.2-00.
-
Medium 6.1
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…
-
Medium 4.3
WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability
Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21.
-
Medium 5.5
XADMaster may not apply quarantine attribute correctly to extracted files
XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only ma…
-
Medium 5.3
Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations…
-
Medium 4.4
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.
-
Medium 4.3
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and ear…
-
Medium 6.5
Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will …
-
Medium 5.3
Apache Airflow: Potentially harmful permission changing by log task handler
Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configur…
-
Medium 5.3
Anope before 2.0.15 does not prevent resetting the password of a suspended account.
-
Medium 6.3
Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access …
-
Medium 4.0
Background task manager has an improper preservation of permissions vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions.
-
Medium 5.4
An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.
-
Medium 5.4
Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this …
-
Medium 4.1
All users can reset the allowed apps list for Nextcloud Guest App users
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests…
-
Medium 4.1
Permissions bypass in Nextcloud with the files zip app
Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1,…
-
Medium 5.4
Incorrect calculation of effective permissions
Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enablin…
-
Medium 6.6
Local privilege escalation
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code wh…
-
Medium 5.4
OpenSearch Issue with tenant read-only permissions
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access…
-
Medium 5.4
Apache Superset: Improper API permission for low privilege users
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
-
Medium 4.1
User access not updated with privilege change in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep…
-
Medium 5.5
ITM Windows Agent Insecure Filesystem Permissions
An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.
-
Medium 5.4
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API c…
-
Medium 4.4
App lockout in nextcloud Android app can be bypassed via thirdparty apps
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a t…
-
Medium 4.4
App pin of the iOS app can be bypassed in Nextcloud iOS
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextclo…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 4.0
Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3.08.2000 in Android 12…
-
Medium 6.3
Improper Preservation of Permissions in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assign…
-
Medium 6.5
Allowed DELETE on resources on object locked buckets under Governance mode in Minio
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Gove…
-
Medium 5.3
The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause user…