# CWE-275.

Every Advisory and CVE whose sources give the weakness CWE-275, newest first.

## Records, newest first

- [devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment](https://agentprime.io/advisories/CVE-2026-105165.md)
  `CVE-2026-105165` · CVE record: devopspolis secrets-replicator · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control, CWE-275
- [Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.](https://agentprime.io/advisories/CVE-2026-49311.md)
  `CVE-2026-49311` · CVE record: Huawei HarmonyOS · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-275
- [xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission](https://agentprime.io/advisories/CVE-2026-75978.md)
  `CVE-2026-75978` · CVE record: xianrendzw EasyReport · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Privilege escalation, CWE-275
- [Uasoft Badaso File API api.php class permission](https://agentprime.io/advisories/CVE-2026-19376.md)
  `CVE-2026-19376` · CVE record: Uasoft Badaso · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Privilege escalation, CWE-275
- [StableBit DrivePool DrivePoolService DrivePool.Service.exe permission](https://agentprime.io/advisories/CVE-2026-19191.md)
  `CVE-2026-19191` · CVE record: StableBit DrivePool · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, CWE-275
- [StableBit Scanner ScannerService Scanner.Service.exe permission](https://agentprime.io/advisories/CVE-2026-19190.md)
  `CVE-2026-19190` · CVE record: StableBit Scanner · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Privilege escalation, CWE-275
- [IObit Malware Fighter DLL permission](https://agentprime.io/advisories/CVE-2026-12201.md)
  `CVE-2026-12201` · CVE record: IObit Malware Fighter · CVSS 4.8 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Privilege escalation, CWE-275
- [Permission control vulnerability in the audio framework.](https://agentprime.io/advisories/CVE-2026-41976.md)
  `CVE-2026-41976` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-275
- [Permission control vulnerability in the clone module.](https://agentprime.io/advisories/CVE-2026-41978.md)
  `CVE-2026-41978` · CVE record: Huawei HarmonyOS · CVSS 4.4 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-275
- [Permission control vulnerability in the projection module.](https://agentprime.io/advisories/CVE-2026-41969.md)
  `CVE-2026-41969` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-275
- [Vulnerability of improper permission control in the theme setting module.](https://agentprime.io/advisories/CVE-2026-28553.md)
  `CVE-2026-28553` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-275
- [Denial of service (DoS) vulnerability in the office service.](https://agentprime.io/advisories/CVE-2025-58288.md)
  `CVE-2025-58288` · CVE record: Huawei HarmonyOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-275
- [Use After Free (UAF) vulnerability in the office service.](https://agentprime.io/advisories/CVE-2025-58287.md)
  `CVE-2025-58287` · CVE record: Huawei HarmonyOS · CVSS 7.8 High · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-275
- [Topaz SERVCore Teller Installer SERVCoreTeller_2.0.40D.msi permission](https://agentprime.io/advisories/CVE-2025-10941.md)
  `CVE-2025-10941` · CVE record: Topaz SERVCore Teller · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2025 · Tags: Privilege escalation, CWE-275
- [LitmusChaos Litmus LocalStorage permission](https://agentprime.io/advisories/CVE-2025-8797.md)
  `CVE-2025-8797` · CVE record: LitmusChaos Litmus · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2025 · Tags: Privilege escalation, CWE-275
- [Unexpected injection event vulnerability in the multimodalinput module.](https://agentprime.io/advisories/CVE-2025-54624.md)
  `CVE-2025-54624` · CVE record: Huawei HarmonyOS · CVSS 5.7 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-275
- [Permission control vulnerability in the distributed clipboard module.](https://agentprime.io/advisories/CVE-2025-54618.md)
  `CVE-2025-54618` · CVE record: Huawei HarmonyOS · CVSS 5.7 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-275
- [Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this vulnerability may allow the peer device to use the camera w…](https://agentprime.io/advisories/CVE-2025-53168.md)
  `CVE-2025-53168` · CVE record: Huawei HarmonyOS · CVSS 5.7 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-275
- [Intelbras InControl HTTP PUT Request operador permission](https://agentprime.io/advisories/CVE-2025-6765.md)
  `CVE-2025-6765` · CVE record: Intelbras InControl · CVSS 5.3 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Privilege escalation, CWE-275
- [ZeroWdd myblog MyBlogMvcConfig.java permission](https://agentprime.io/advisories/CVE-2024-13189.md)
  `CVE-2024-13189` · CVE record: ZeroWdd myblog · CVSS 6.9 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: Privilege escalation, CWE-275
- [Code4Berry Decoration Management System User Permission user_permission.php](https://agentprime.io/advisories/CVE-2024-11486.md)
  `CVE-2024-11486` · CVE record: Code4Berry Decoration Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Privilege escalation, CWE-275
- [Code4Berry Decoration Management System User userregister.php permission](https://agentprime.io/advisories/CVE-2024-11485.md)
  `CVE-2024-11485` · CVE record: Code4Berry Decoration Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Privilege escalation, CWE-275
- [Dreamer CMS Attachment permission](https://agentprime.io/advisories/CVE-2024-3118.md)
  `CVE-2024-3118` · CVE record: Dreamer CMS · CVSS 6.3 Medium · Not analysed yet · Published 31 Mar 2024 · Tags: CWE-275
- [Thecosy IceCMS Article permission](https://agentprime.io/advisories/CVE-2023-6762.md)
  `CVE-2023-6762` · CVE record: Thecosy IceCMS · CVSS 5.4 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: CWE-275
- [CSZCMS File Manager Page templates permission](https://agentprime.io/advisories/CVE-2023-6302.md)
  `CVE-2023-6302` · CVE record: CSZCMS · CVSS 4.7 Medium · Not analysed yet · Published 27 Nov 2023 · Tags: Broken access control, CWE-275
- [ZZZCMS Database Backup File save.php restore permission](https://agentprime.io/advisories/CVE-2023-5263.md)
  `CVE-2023-5263` · CVE record: ZZZCMS · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-275
- [Improper authorization in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39399.md)
  `CVE-2023-39399` · CVE record: Huawei HarmonyOS and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2023 · Tags: Broken access control, CWE-275
- [Improper authorization in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39398.md)
  `CVE-2023-39398` · CVE record: Huawei HarmonyOS and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2023 · Tags: Broken access control, CWE-275
- [Intergard SGS permission](https://agentprime.io/advisories/CVE-2023-3759.md)
  `CVE-2023-3759` · CVE record: Intergard SGS · CVSS 6.3 Medium · Not analysed yet · Published 19 Jul 2023 · Tags: CWE-275
- [Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module.](https://agentprime.io/advisories/CVE-2023-37238.md)
  `CVE-2023-37238` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-275
- [cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges](https://agentprime.io/advisories/CVE-2022-22251.md)
  `CVE-2022-22251` · CVE record: Juniper Networks Junos OS · CVSS 7.8 High · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-257, CWE-275
- [ITarian - Local privilege escalation in Endpoint Manager agent on Windows](https://agentprime.io/advisories/CVE-2022-25153.md)
  `CVE-2022-25153` · CVE record: ITarian Endpoint Manager Communication Client for Windows · CVSS 7.8 High · Not analysed yet · Published 8 Jun 2022 · Tags: CWE-275
- [Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues](https://agentprime.io/advisories/CVE-2020-14496.md)
  `CVE-2020-14496` · CVE record: Mitsubishi Electric CPU Module Logging Configuration Tool and 4 more · CVSS 8.3 High · Not analysed yet · Published 19 May 2022 · Tags: CWE-275
- [Local Priviledge escalation in Perfetto Dev scripts](https://agentprime.io/advisories/CVE-2022-0343.md)
  `CVE-2022-0343` · CVE record: Google LLC Perfetto Dev Scripts · CVSS 3.3 Low · Not analysed yet · Published 29 Mar 2022 · Tags: CWE-275
- [Memory leak in ICMP6 in Linux Kernel](https://agentprime.io/advisories/CVE-2022-0742.md)
  `CVE-2022-0742` · CVE record: Linux Kernel · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2022 · Tags: CWE-275
- [Information Leak in SA360-webquery-bigquery through read on /tmp](https://agentprime.io/advisories/CVE-2021-22571.md)
  `CVE-2021-22571` · CVE record: Google LLC google/sa360-webquery-bigquery · CVSS 5.5 Medium · Not analysed yet · Published 18 Mar 2022 · Tags: CWE-275
- [GateManager information leak for LinkManager Users](https://agentprime.io/advisories/CVE-2021-32006.md)
  `CVE-2021-32006` · CVE record: Secomea GateManager · CVSS 5.0 Medium · Not analysed yet · Published 7 Mar 2022 · Tags: CWE-274, CWE-275
- [Incorrect mapping of Executable bits in Fuchsia Kernel](https://agentprime.io/advisories/CVE-2021-22566.md)
  `CVE-2021-22566` · CVE record: Google LLC Fuchsia · CVSS 5.1 Medium · Not analysed yet · Published 18 Jan 2022 · Tags: CWE-275
- [Insecure file and directory permissions on EdgeRover](https://agentprime.io/advisories/CVE-2022-22988.md)
  `CVE-2022-22988` · CVE record: Western Digital EdgeRover · CVSS 7.7 High · Not analysed yet · Published 13 Jan 2022 · Tags: CWE-275
- [Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-1437.md)
  `CVE-2021-1437` · CVE record: Cisco Cisco Aironet Access Point Software · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2021 · Tags: CWE-275
- [Check Point ZoneAlarm: Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete…](https://agentprime.io/advisories/CVE-2020-6022.md)
  `CVE-2020-6022` · CVE record: Check Point ZoneAlarm · No CVSS score · Not analysed yet · Published 27 Oct 2020 · Tags: CWE-275
- [Cisco Connected Mobile Experiences Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3152.md)
  `CVE-2020-3152` · CVE record: Cisco Cisco Connected Mobile Experiences · CVSS 6.7 Medium · Not analysed yet · Published 26 Aug 2020 · Tags: CWE-275
- [Location service uses cached authorization even after revocation](https://agentprime.io/advisories/CVE-2014-1422.md)
  `CVE-2014-1422` · CVE record: Canonical trust-store (Ubuntu) and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 22 Jul 2020 · Tags: CWE-275
- [ABB Central Licensing System - Weak File Permissions](https://agentprime.io/advisories/CVE-2020-8471.md)
  `CVE-2020-8471` · CVE record: ABB Central Licensing System and 4 more · CVSS 7.8 High · Not analysed yet · Published 29 Apr 2020 · Tags: CWE-275
- [ABB System 800xA Weak Registry Permissions](https://agentprime.io/advisories/CVE-2020-8474.md)
  `CVE-2020-8474` · CVE record: ABB System 800xA Base · CVSS 7.8 High · Not analysed yet · Published 22 Apr 2020 · Tags: CWE-275
- [Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2019-15962.md)
  `CVE-2019-15962` · CVE record: Cisco Cisco TelePresence TC Software · CVSS 4.4 Medium · Not analysed yet · Published 16 Oct 2019 · Tags: CWE-275
- [Cisco RoomOS Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2019-12622.md)
  `CVE-2019-12622` · CVE record: Cisco Cisco TelePresence CE Software · CVSS 4.1 Medium · Not analysed yet · Published 21 Aug 2019 · Tags: CWE-275
- [Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Tetration Analytics Agent Arbitrary Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2019-1618.md)
  `CVE-2019-1618` · CVE record: Cisco Nexus 9000 Series Switches in Standalone NX-OS Mode · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2019 · Tags: CWE-275
- [Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability](https://agentprime.io/advisories/CVE-2018-0449.md)
  `CVE-2018-0449` · CVE record: Cisco Cisco Jabber for Mac · CVSS 5.1 Medium · Not analysed yet · Published 10 Jan 2019 · Tags: CWE-275
- [Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2018-15379.md)
  `CVE-2018-15379` · CVE record: Cisco Cisco Prime Infrastructure · No CVSS score · EPSS 0.86 · Not analysed yet · Published 5 Oct 2018 · Tags: CWE-275
- [A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user.](https://agentprime.io/advisories/CVE-2018-0392.md)
  `CVE-2018-0392` · CVE record: Cisco Policy Suite unknown · No CVSS score · Not analysed yet · Published 18 Jul 2018 · Tags: CWE-275
- [Nextcloud Server: Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only…](https://agentprime.io/advisories/CVE-2017-0884.md)
  `CVE-2017-0884` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: CWE-275
- [Nextcloud Server: Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on…](https://agentprime.io/advisories/CVE-2017-0883.md)
  `CVE-2017-0883` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: CWE-275
- [Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file.](https://agentprime.io/advisories/CVE-2016-9462.md)
  `CVE-2016-9462` · CVE record: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 · No CVSS score · Not analysed yet · Published 28 Mar 2017 · Tags: CWE-275
- [Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions.](https://agentprime.io/advisories/CVE-2016-9461.md)
  `CVE-2016-9461` · CVE record: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 · No CVSS score · Not analysed yet · Published 28 Mar 2017 · Tags: CWE-275

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-275>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-275/>. Everything for agents: <https://agentprime.io/llms.txt>.