# CWE-279.

Every Advisory and CVE whose sources give the weakness CWE-279, newest first.

## Records, newest first

- [osquery: Unprivileged users can temporarily read file carve contents](https://agentprime.io/advisories/CVE-2026-46388.md)
  `CVE-2026-46388` · CVE record: osquery osquery · CVSS 4.4 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-279, CWE-378, CWE-379
- [Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization](https://agentprime.io/advisories/CVE-2026-4948.md)
  `CVE-2026-4948` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-279
- [Cisco Secure Firewall Adaptive Security Appliance (ASA)…: A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA)…](https://agentprime.io/advisories/CVE-2026-20062.md)
  `CVE-2026-20062` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · CVSS 7.2 High · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-279
- [Nfs-utils: rpc.mountd in the nfs-utils privilege escalation](https://agentprime.io/advisories/CVE-2025-12801.md)
  `CVE-2025-12801` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-279
- [Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions](https://agentprime.io/advisories/CVE-2025-14025.md)
  `CVE-2025-14025` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-279
- [Incorrect Execution-Assigned Permissions in IBM Aspera Faspex](https://agentprime.io/advisories/CVE-2025-36228.md)
  `CVE-2025-36228` · CVE record: IBM Aspera Faspex 5 · CVSS 3.8 Low · Not analysed yet · Published 26 Dec 2025 · Tags: CWE-279
- [Quartus Prime Pro Edition Installer Advisory](https://agentprime.io/advisories/CVE-2025-13663.md)
  `CVE-2025-13663` · CVE record: Altera Quartus Prime Pro · CVSS 5.4 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-279
- [containerd affected by a local privilege escalation via wide permissions on CRI directory](https://agentprime.io/advisories/GHSA-pwhc-rpq9-4c8w.md)
  `GHSA-pwhc-rpq9-4c8w`, `CVE-2024-25621`, `GO-2025-4100` · Go `github.com/containerd/containerd` and 1 more: affected `<1.7.29`, fixed in `1.7.29` · CVSS 7.3 High · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-279
- [Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability](https://agentprime.io/advisories/GHSA-6wwv-6mm3-pp76.md)
  `GHSA-6wwv-6mm3-pp76`, `CVE-2025-30001` · Maven `org.apache.streampark:streampark`: affected `<=2.1.5`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-279
- [Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder](https://agentprime.io/advisories/GHSA-j6xf-jwrj-v5qp.md)
  `GHSA-j6xf-jwrj-v5qp`, `CVE-2025-58437`, `GO-2025-3938` · Go `github.com/coder/coder` and 1 more: affected `*`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2025 · Tags: Authentication bypass, CWE-277, CWE-279
- [In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check.](https://agentprime.io/advisories/CVE-2025-26422.md)
  `CVE-2025-26422` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-279
- [NVIDIA DOCA-Host and Mellanox OFED: NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature…](https://agentprime.io/advisories/CVE-2025-23263.md)
  `CVE-2025-23263` · CVE record: NVIDIA DOCA-Host and Mellanox OFED · CVSS 7.6 High · Not analysed yet · Published 17 Jul 2025 · Tags: CWE-279
- [Edge Orchestrator software for Intel(R) Tiber™ Edge Platform: Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R)…](https://agentprime.io/advisories/CVE-2025-23233.md)
  `CVE-2025-23233` · CVE record: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-279
- [Edge Orchestrator software for Intel(R) Tiber™ Edge Platform: Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R)…](https://agentprime.io/advisories/CVE-2025-22843.md)
  `CVE-2025-22843` · CVE record: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 8.8 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-279
- [Edge Orchestrator software for Intel(R) Tiber™ Edge Platform: Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R)…](https://agentprime.io/advisories/CVE-2025-20612.md)
  `CVE-2025-20612` · CVE record: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 5.1 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-279
- [aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role](https://agentprime.io/advisories/GHSA-qc59-cxj2-c2w4.md)
  `GHSA-qc59-cxj2-c2w4` · npm `aws-cdk-lib`: affected `>=2.172.0, <2.189.1`, fixed in `2.189.1` · CVSS 2.2 Low · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-279
- [Intel(R) 800 Series Ethernet Driver: Incorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R)…](https://agentprime.io/advisories/CVE-2024-39286.md)
  `CVE-2024-39286` · CVE record: Intel(R) 800 Series Ethernet Driver · CVSS 2.0 Low · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-279
- [Open Automation Software Incorrect Execution-Assigned Permissions](https://agentprime.io/advisories/CVE-2024-11220.md)
  `CVE-2024-11220` · CVE record: Open Automation Software Open Automation Software · CVSS 8.5 High · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-279
- [Intel(R) Advanced Link Analyzer Standard Edition software…: Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard…](https://agentprime.io/advisories/CVE-2024-37025.md)
  `CVE-2024-37025` · CVE record: Intel(R) Advanced Link Analyzer Standard Edition software installer · CVSS 5.4 Medium · Not analysed yet · Published 13 Nov 2024 · Tags: CWE-279
- [An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.](https://agentprime.io/advisories/CVE-2024-37734.md)
  `CVE-2024-37734` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2024 · Tags: CWE-279
- [A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to change the DACL of arbitrary system directori…](https://agentprime.io/advisories/CVE-2023-50914.md)
  `CVE-2023-50914` · CVE record · CVSS 6.7 Medium · Not analysed yet · Published 30 Apr 2024 · Tags: CWE-279
- [Privilage Escalation in Saphira Connect](https://agentprime.io/advisories/CVE-2023-4665.md)
  `CVE-2023-4665` · CVE record: Saphira Saphira Connect · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2023 · Tags: CWE-279
- [Incorrect Execution-Assigned Permissions in GitLab](https://agentprime.io/advisories/CVE-2023-3915.md)
  `CVE-2023-3915` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2023 · Tags: CWE-279
- [MicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissions](https://agentprime.io/advisories/CVE-2023-4383.md)
  `CVE-2023-4383` · CVE record: MicroWorld eScan Anti-Virus · CVSS 7.8 High · Not analysed yet · Published 16 Aug 2023 · Tags: CWE-279
- [Execution with Unnecessary Privileges in ipython](https://agentprime.io/advisories/GHSA-pq7m-3gw7-gq5x.md)
  `GHSA-pq7m-3gw7-gq5x`, `CVE-2022-21699`, `PYSEC-2022-12` · PyPI `ipython`: affected `<5.11 || >=6.0.0, <7.16.3 || >=7.17.0, <7.31.1 || >=8.0.0, <8.0.1`, fixed in `5.11`, `7.16.3`, `7.31.1`, `8.0.1` · CVSS 8.2 High · Not analysed yet · Published 21 Jan 2022 · Tags: Privilege escalation, CWE-279
- [Permissions bypass in pleaser](https://agentprime.io/advisories/GHSA-vc5p-j8vw-mc6x.md)
  `GHSA-vc5p-j8vw-mc6x`, `CVE-2021-31155`, `RUSTSEC-2021-0101` · crates.io `pleaser`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2021 · Tags: Privilege escalation, CWE-279
- [Improper permission handling in Apache Solr](https://agentprime.io/advisories/GHSA-jgcr-fg3g-qvw8.md)
  `GHSA-jgcr-fg3g-qvw8`, `BIT-solr-2021-29262`, `CVE-2021-29262` · Maven `org.apache.solr:solr-core`: affected `<8.8.2`, fixed in `8.8.2` · CVSS 7.5 High · Not analysed yet · Published 10 May 2021 · Tags: Hard-coded credentials, CWE-279
- [outdated entries in permissions profiles for /var/lib/pcp/tmp/\* may cause security issues](https://agentprime.io/advisories/CVE-2020-8025.md)
  `CVE-2020-8025` · CVE record: SUSE SUSE Linux Enterprise Server 12-SP4 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 7 Aug 2020 · Tags: CWE-279
- [Elastic X-Pack Security: Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply…](https://agentprime.io/advisories/CVE-2017-8441.md)
  `CVE-2017-8441` · CVE record: Elastic X-Pack Security · No CVSS score · Not analysed yet · Published 5 Jun 2017 · Tags: CWE-279

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-279>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-279/>. Everything for agents: <https://agentprime.io/llms.txt>.