Weakness (CWE)
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Source: MITRE CWE-281
255 results · Feed
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera exten…
-
High 8.8
Improper Preservation of Permissions in xxl-job
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
-
Medium 4.3
System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
-
Medium 6.1
Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
-
High 7.2
Zscaler bypass with administrative privileges on Windows
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
-
Medium 5.3
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1…
-
High 7.1
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macO…
-
High 7.7
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS …
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ve…
-
High 7.7
This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sono…
-
High 8.4
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS…
-
High 8.4
An input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, m…
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify pr…
-
Medium 4.8
Tuleap's recursive permissions to document manager folder are not properly applied
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this fol…
-
Medium 6.5
Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application E…
-
Medium 5.1
File Permission Vulnerability in Hitachi Ops Center Common Services
Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue affects Hitachi Ops Center Common Services: before 11.0.2-00.
-
Critical 10.0
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining th…
-
Low 3.7
Permissions processing error in spacedb
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.…
-
High 7.1
Permission and Access Control Vulnerability in ZTE H388X
There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific o…
-
High 7.8
Privilege Escalation
When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secur…
-
High 7.8
When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.…
-
Low 3.9
Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. I…
-
Medium 6.1
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…
-
Medium 4.3
WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability
Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21.
-
Low 2.7
Permission check bypass when editing a model with per-field restrictions in wagtail
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been us…
-
Medium 5.5
XADMaster may not apply quarantine attribute correctly to extracted files
XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only ma…
-
Medium 5.3
Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations…
-
Low 1.6
Authelia's Group Changes may not have the expected results (YAML file backend)
### Impact Under very specific conditions changes to a users groups may not have the expected results. The specific conditions are: * The file authentication backend is being used. * The [watch](https://www.authelia.com/configuration/first-factor/file/#watch)…
-
Medium 4.4
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type
HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.
-
Medium 4.3
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and ear…
-
Medium 6.5
Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will …
-
Low 3.3
Audio has an improper preservation of permissions vulnerability
in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission.
-
Medium 5.3
Apache Airflow: Potentially harmful permission changing by log task handler
Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configur…
-
Medium 5.3
Anope before 2.0.15 does not prevent resetting the password of a suspended account.
-
High 8.1
Apache Airflow: Ignored Airflow Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airf…
-
Medium 6.3
Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access …