Advisories · Weakness
CWE-277.
Every Advisory and CVE whose sources give the weakness CWE-277, newest first.
- CVSS 5.5 Medium
Podman: arbitrary file write when importing oci archive
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- CWE-277
- CVSS 7.3 High
Lenovo Legion Zone: A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo…
- Lenovo Legion Zone
- Lenovo App Store
- CWE-277
- CVSS 6.5 Medium
view_component: Preview Route Can Dispatch Inherited Helper Methods
- CWE-277
- CWE-749
>=3.0.0, <4.9.0 · fixed in 4.9.0
GHSA-7f3r-gwc9-2995 · CVE-2026-44836 - CVSS 2.3 Low
OpenClaw's ACP child sessions inherit subagent security envelope constraints
- Privilege escalation
- CWE-277
<2026.4.22 · fixed in 2026.4.22
GHSA-q3jj-46pq-826r · CVE-2026-44997 - CVSS 7.8 High
Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file
- CWE-277
- CVSS 5.5 Medium
A permissions issue was addressed with additional restrictions.
- Apple macOS
- CWE-277
- CVSS 5.4 Medium
Intel(R) Graphics Software: Insecure inherited permissions for some Intel(R) Graphics Software before version…
- Intel(R) Graphics Software
- CWE-277
- CVSS 7.2 High
Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- CWE-277
- CVSS 2.9 Low
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
- CWE-277
<1.47.1 · fixed in 1.47.1
GHSA-9m7r-g8hg-x3vr · CVE-2025-65111 - CVSS 6.9 Medium
Open OnDemand RPM packages create world writable locations
- OSC ondemand
- Information disclosure
- CWE-277
- CVSS 5.4 Medium
Intel(R) Rapid Storage Technology Application: Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application…
- Intel(R) Rapid Storage Technology Application
- CWE-277
- CVSS 5.3 Medium
Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
- Portabilis i-Educar
- Privilege escalation
- CWE-277
- CVSS 6.5 Medium
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy (BLE) without authentication.
- CWE-277
- CVSS 8.1 High
Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder
- Authentication bypass
- CWE-277
* · no fixed version yet
GHSA-j6xf-jwrj-v5qp · CVE-2025-58437 - CVSS 5.3 Medium
Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent
- CWE-277
>=0.0.3, <1.97.1 · fixed in 1.97.1
GHSA-wm7x-ww72-r77q · CVE-2025-9039 - CVSS 6.5 Medium
IBM Storage Scale information disclosure
- IBM Storage Scale
- CWE-277
- CVSS 6.0 Medium
Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution
- conda-build
- CWE-277
- CVSS 6.7 Medium
IBM Security Guardium privilege escalation
- IBM Security Guardium
- CWE-277
- CVSS 5.1 Medium
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
- CWE-277
<1.0.0 · fixed in 1.0.0
GHSA-m4jx-m5hg-qrxx · CVE-2018-25111 - CVSS 6.9 Medium
Intel(R) Simics(R) Package Manager software: Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software…
- Intel(R) Simics(R) Package Manager software
- CWE-277
- CVSS 5.4 Medium
Intel(R) Ethernet Network Adapter E810 Series: Insecure inherited permissions in the NVM Update Utility for some Intel(R) Ethernet…
- Intel(R) Ethernet Network Adapter E810 Series
- CWE-277
- CVSS 5.4 Medium
Intel(R) Simics(R) Package Manager software: Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software…
- Intel(R) Simics(R) Package Manager software
- CWE-277
- CVSS 6.6 Medium
Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform
- SAP_SE SAP BusinessObjects Business Intelligence Platform
- CWE-277
- CVSS 6.8 Medium
Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.1…
- Dell Wyse Management Suite
- CWE-277
- CVSS 5.5 Medium
The issue was addressed with improved checks.
- Apple macOS
- CWE-277
- CVSS 6.7 Medium
IBM Robotic Process Automation privilege escalation
- IBM Robotic Process Automation
- CWE-277
- CVSS 5.4 Medium
Intel(R) DSA software: Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8…
- Intel(R) DSA software
- CWE-277
- CVSS 5.4 Medium
Intel(R) CIP software: Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852…
- Intel(R) CIP software
- CWE-277
- CVSS 3.8 Low
TCC Bypass in Cursor's macOS Application
- cursor
- CWE-277
- CVSS 8.8 High
Improper Preservation of Permissions in xxl-job
- Broken access control
- CWE-277
<2.4.2 · fixed in 2.4.2
GHSA-cpfp-m5qw-c4r3 · CVE-2024-42681 - CVSS 5.4 Medium
Intel(R) HID Event Filter software installers: Insecure inherited permissions in some Intel(R) HID Event Filter software installers…
- Intel(R) HID Event Filter software installers
- CWE-277
- CVSS 5.4 Medium
Flexlm License Daemons for Intel(R) FPGA software: Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software…
- Flexlm License Daemons for Intel(R) FPGA software
- CWE-277
- CVSS 6.7 Medium
Pulp incorrectly assigns RBAC permissions in tasks that create objects
- CWE-277
<=3.56.0 · no fixed version yet
GHSA-9m5j-4xx9-44j9 · CVE-2024-7143 - CVSS 8.8 High
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CWE-277
- CVSS 9.8 CriticalCritical · CVSS 9+
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CWE-277
- CVSS 9.8 CriticalCritical · CVSS 9+
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CWE-277
- CVSS 8.4 High
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafte…
- CWE-277
- CVSS 7.5 High
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- CWE-277
- CVSS 8.8 High
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
- Code injection
- CWE-277
>=2.4.0, <2.9.3 · fixed in 2.9.3
GHSA-g5hv-r743-v8pm · CVE-2024-39877 - CVSS 8.8 High
Firefox Android missed activation delay to prevent tapjacking
- Mozilla Firefox
- CWE-277
- CVSS 6.3 Medium
Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information.
- CWE-277
- CVSS 7.4 High
This issue was addressed with improved permissions checking.
- Apple iOS and iPadOS
- Apple macOS
- CWE-277
- CVSS 6.7 Medium
Intel(R) Power Gadget software for Windows: Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions…
- Intel(R) Power Gadget software for Windows
- CWE-277
- CVSS 6.7 Medium
Intel(R) XTU software: Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may…
- Intel(R) XTU software
- CWE-277
- CVSS 7.4 High
This issue was addressed with improved checks.
- Apple iOS and iPadOS
- Apple macOS
- CWE-277
- CVSS 7.4 High
A logic issue was addressed with improved restrictions.
- Apple macOS
- CWE-277
- CVSS 7.8 High
Apple macOS: A downgrade issue affecting Intel-based Mac computers was addressed with additional…
- Apple macOS
- CWE-277
- CVSS 8.4 High
Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.
- CWE-277
- CVSS 7.8 High
This issue was addressed with improved checks.
- Apple macOS
- CWE-277
- CVSS 6.7 Medium
Intel(R) Ethernet tools and driver install software: Insecure inherited permissions in some Intel(R) Ethernet tools and driver install…
- Intel(R) Ethernet tools and driver install software
- CWE-277
- CVSS 6.7 Medium
Intel HID Event Filter drivers for Windows 10 for some…: Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for…
- Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers
- CWE-277
- CVSS 4.1 Medium
Overly Permissive Access Policy
- Becton, Dickinson and Company (BD) FACSChorus
- CWE-277
- CVSS 6.7 Medium
Improper privilege management in Intel(R) NUC Pro Software Suite installation software
- Intel(R) NUC Pro Software Suite installation software
- Privilege escalation
- CWE-277
- CVSS 6.7 Medium
Intel(R) NUC Watchdog Timer installation software: Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software…
- Intel(R) NUC Watchdog Timer installation software
- CWE-277
- CVSS 6.7 Medium
Intel Server Configuration Utility software: Insecure inherited permissions in the installer for some Intel Server Configuration…
- Intel Server Configuration Utility software
- CWE-277
- CVSS 6.7 Medium
Intel(R) Simics Simulator software: Insecure inherited permissions in some Intel(R) Simics Simulator software before version…
- Intel(R) Simics Simulator software
- CWE-277
- CVSS 6.7 Medium
Intel Rapid Storage Technology software: Insecure inherited permissions in some Intel Rapid Storage Technology software before…
- Intel Rapid Storage Technology software
- CWE-277
- CVSS 7.4 High
Insecure Inherited Permissions
- Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software
- CWE-277
- CVSS 6.7 Medium
Intel(R) oneMKL software: Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may…
- Intel(R) oneMKL software
- CWE-277
- CVSS 7.8 High
Denial of Service (DoS) vulnerability in SAP SQL Anywhere
- SAP_SE SAP SQL Anywhere
- Broken access control
- CWE-277