# CWE-280.

Every Advisory and CVE whose sources give the weakness CWE-280, newest first.

## Records, newest first (an older page)

- [Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (\`extras.view_dynamicgroup\` permission) can use the Dynamic Group detail...](https://agentprime.io/advisories/GHSA-qmjf-wc2h-6x3q.md)
  `GHSA-qmjf-wc2h-6x3q`, `CVE-2024-36112`, `PYSEC-2024-166` · PyPI `nautobot`: affected `>=2.0.0, <2.3.0b1`, fixed in `2.3.0b1` · CVSS 6.3 Medium · Not analysed yet · Published 28 May 2024 · Tags: CWE-280, CWE-755
- [Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.](https://agentprime.io/advisories/CVE-2024-29852.md)
  `CVE-2024-29852` · CVE record: Veeam Backup & Replication · CVSS 2.7 Low · Not analysed yet · Published 22 May 2024 · Tags: CWE-280
- [JetBrains TeamCity: In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope…](https://agentprime.io/advisories/CVE-2024-35301.md)
  `CVE-2024-35301` · CVE record: JetBrains TeamCity · CVSS 5.5 Medium · Not analysed yet · Published 16 May 2024 · Tags: CWE-280
- [A downgrade issue was addressed with additional code-signing restrictions.](https://agentprime.io/advisories/CVE-2024-27837.md)
  `CVE-2024-27837` · CVE record: Apple macOS · CVSS 7.7 High · Not analysed yet · Published 13 May 2024 · Tags: CWE-280
- [In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check.](https://agentprime.io/advisories/CVE-2024-23704.md)
  `CVE-2024-23704` · CVE record: Google Android · CVSS 7.0 High · Not analysed yet · Published 7 May 2024 · Tags: CWE-280
- [Wagtail has permission check bypass when editing a model with per-field restrictions through \`wagtail.contrib.settings\` or \`ModelViewSet\`](https://agentprime.io/advisories/GHSA-w2v8-php4-p8hc.md)
  `GHSA-w2v8-php4-p8hc`, `CVE-2024-32882`, `PYSEC-2026-2031` · PyPI `wagtail`: affected `>=6.0.0, <6.0.3`, fixed in `6.0.3` · CVSS 2.7 Low · Not analysed yet · Published 1 May 2024 · Tags: CWE-280, CWE-281
- [Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or sp…](https://agentprime.io/advisories/CVE-2023-38298.md)
  `CVE-2023-38298` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Apr 2024 · Tags: Privilege escalation, Broken access control, CWE-280
- [In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL fi…](https://agentprime.io/advisories/CVE-2024-32488.md)
  `CVE-2024-32488` · CVE record · CVSS 7.8 High · Not analysed yet · Published 15 Apr 2024 · Tags: CWE-280
- [Mautic Sensitive Data Exposure due to inadequate user permission settings](https://agentprime.io/advisories/GHSA-qjx3-2g35-6hv8.md)
  `GHSA-qjx3-2g35-6hv8`, `CVE-2022-25776`, `PKSA-h1nj-n1bm-2hgs` · Packagist `mautic/core`: affected `>=1.0.2, <4.4.12 || >=5.0.0-alpha, <5.0.4`, fixed in `4.4.12`, `5.0.4` · CVSS 8.3 High · Not analysed yet · Published 12 Apr 2024 · Tags: Broken access control, CWE-280
- [Matrix IRC Bridge truncated content of messages can be leaked](https://agentprime.io/advisories/GHSA-wm4w-7h2q-3pf7.md)
  `GHSA-wm4w-7h2q-3pf7`, `CVE-2024-32000` · npm `matrix-appservice-irc`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 11 Apr 2024 · Tags: CWE-280, CWE-755
- [Improper access control in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-52537.md)
  `CVE-2023-52537` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2024 · Tags: Broken access control, CWE-280
- [Improper access control in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2024-30418.md)
  `CVE-2024-30418` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 7 Apr 2024 · Tags: Broken access control, CWE-280
- [there is a possible way to bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2024-29748.md)
  `CVE-2024-29748` · CVE record: Google Android · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Apr 2024 · Tags: CWE-280
- [The issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2023-42931.md)
  `CVE-2023-42931` · CVE record: Apple macOS · CVSS 8.3 High · Not analysed yet · Published 28 Mar 2024 · Tags: CWE-280
- [Revert password check incorrect type validation](https://agentprime.io/advisories/CVE-2023-41972.md)
  `CVE-2023-41972` · CVE record: Zscaler Client Connector · CVSS 7.3 High · Not analysed yet · Published 26 Mar 2024 · Tags: CWE-280
- [An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.](https://agentprime.io/advisories/CVE-2024-22078.md)
  `CVE-2024-22078` · CVE record · CVSS 8.8 High · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-280
- [An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.](https://agentprime.io/advisories/CVE-2024-22077.md)
  `CVE-2024-22077` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-280
- [An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive informatio…](https://agentprime.io/advisories/CVE-2024-25844.md)
  `CVE-2024-25844` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2024 · Tags: CWE-280
- [Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions](https://agentprime.io/advisories/CVE-2024-0560.md)
  `CVE-2024-0560` · CVE record: Red Hat Red Hat 3scale API Management Platform 2 · CVSS 6.3 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: CWE-280
- [OPPO Usercenter Credit sdk](https://agentprime.io/advisories/CVE-2024-1608.md)
  `CVE-2024-1608` · CVE record: OPPO Usercenter Credit sdk · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-280
- [In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.](https://agentprime.io/advisories/CVE-2024-0015.md)
  `CVE-2024-0015` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 16 Feb 2024 · Tags: CWE-280
- [Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the Support…](https://agentprime.io/advisories/CVE-2023-39249.md)
  `CVE-2023-39249` · CVE record: Dell SupportAssist Client Consumer · CVSS 6.3 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: CWE-280
- [Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions](https://agentprime.io/advisories/GHSA-gccq-h3xj-jgvf.md)
  `GHSA-gccq-h3xj-jgvf`, `CVE-2024-25108`, `PKSA-bgxg-jhn7-yhxd` · Packagist `pixelfed/pixelfed`: affected `>=0.10.4, <0.11.11`, fixed in `0.11.11` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2024 · Tags: Broken access control, CWE-280
- [Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service.](https://agentprime.io/advisories/CVE-2023-25543.md)
  `CVE-2023-25543` · CVE record: Dell Dell Power Manager (DPM) · CVSS 7.8 High · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-280
- [Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability](https://agentprime.io/advisories/GHSA-8j3x-w35r-rw4r.md)
  `GHSA-8j3x-w35r-rw4r`, `CVE-2023-6267` · Maven `io.quarkus.resteasy.reactive:resteasy-reactive`: affected `<2.13.9.Final || >=3.0.0.Final, <3.2.9.Final`, fixed in `2.13.9.Final`, `3.2.9.Final` · CVSS 8.6 High · Not analysed yet · Published 25 Jan 2024 · Tags: Insecure deserialization, CWE-280, CWE-755
- [Improper Permission Handling in M-Files Server](https://agentprime.io/advisories/CVE-2023-6189.md)
  `CVE-2023-6189` · CVE record: M-Files M-Files Server · CVSS 4.3 Medium · Not analysed yet · Published 22 Nov 2023 · Tags: CWE-280
- [Zoom Video Communications, Inc. Zoom Rooms for macOS: Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an…](https://agentprime.io/advisories/CVE-2023-43591.md)
  `CVE-2023-43591` · CVE record: Zoom Video Communications, Inc. Zoom Rooms for macOS · CVSS 7.8 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-280
- [Dell PowerScale OneFS: Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of…](https://agentprime.io/advisories/CVE-2023-43087.md)
  `CVE-2023-43087` · CVE record: Dell PowerScale OneFS · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2023 · Tags: CWE-280
- [Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability.](https://agentprime.io/advisories/CVE-2023-32489.md)
  `CVE-2023-32489` · CVE record: Dell PowerScale OneFS · CVSS 6.7 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: CWE-280
- [Elevation of Privilege in M-Files Desktop Client](https://agentprime.io/advisories/CVE-2023-2480.md)
  `CVE-2023-2480` · CVE record: M-Files M-Files Client · CVSS 7.5 High · Not analysed yet · Published 25 May 2023 · Tags: CWE-280
- [Unauthorized scheduling of downtimes via REST API](https://agentprime.io/advisories/CVE-2023-2020.md)
  `CVE-2023-2020` · CVE record: Tribe29 Checkmk · CVSS 4.3 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-280
- [NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and da…](https://agentprime.io/advisories/CVE-2023-0181.md)
  `CVE-2023-0181` · CVE record: NVIDIA vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) · CVSS 7.1 High · Not analysed yet · Published 1 Apr 2023 · Tags: CWE-280
- [Apiman vulnerable to permissions bypass due to missing check on API key URL](https://agentprime.io/advisories/GHSA-m6f8-hjrv-mw5f.md)
  `GHSA-m6f8-hjrv-mw5f`, `CVE-2023-28640` · Maven `io.apiman:apiman-manager-api-rest-impl`: affected `<3.1.0.Final`, fixed in `3.1.0.Final` · CVSS 6.4 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: Privilege escalation, Broken access control, CWE-280
- [\`cilium-cli\` disables etcd authorization for clustermesh clusters](https://agentprime.io/advisories/GHSA-6f27-3p6c-p5jc.md)
  `GHSA-6f27-3p6c-p5jc`, `CVE-2023-28114`, `GO-2023-1653` · Go `github.com/cilium/cilium-cli`: affected `<0.13.2`, fixed in `0.13.2` · CVSS 4.8 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: CWE-280, CWE-755
- [Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter](https://agentprime.io/advisories/GHSA-jhjm-5xjg-mpqp.md)
  `GHSA-jhjm-5xjg-mpqp`, `CVE-2023-27087` · Maven `com.xuxueli:xxl-job`: affected `>=2.2.0, <=2.3.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 21 Mar 2023 · Tags: CWE-280
- [Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN.](https://agentprime.io/advisories/CVE-2023-21421.md)
  `CVE-2023-21421` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 9 Feb 2023 · Tags: CWE-280
- [wire-server vulnerable to unauthorized removal of Bots from Conversations](https://agentprime.io/advisories/CVE-2023-22737.md)
  `CVE-2023-22737` · CVE record: wireapp wire-server · CVSS 6.5 Medium · Not analysed yet · Published 27 Jan 2023 · Tags: Broken access control, CWE-280
- [Duplicate Advisory: Apiman has insufficient checks for read permissions](https://agentprime.io/advisories/GHSA-54r5-wr8x-x5v3.md)
  `GHSA-54r5-wr8x-x5v3` · Maven `io.apiman:apiman-manager-api-rest-impl`: affected `>=1.5.7, <3.0.0.Final`, fixed in `3.0.0.Final` · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 20 Dec 2022 · Tags: Broken access control, CWE-280
- [Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to set some setting value in Secure folder.](https://agentprime.io/advisories/CVE-2022-39912.md)
  `CVE-2022-39912` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-280
- [Missing permissions check in Liferay Portal](https://agentprime.io/advisories/GHSA-642h-mx8q-47p2.md)
  `GHSA-642h-mx8q-47p2`, `BIT-liferay-2022-42126`, `CVE-2022-42126` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.3.5, <7.4.3.48`, fixed in `7.4.3.48` · CVSS 4.3 Medium · Not analysed yet · Published 15 Nov 2022 · Tags: Broken access control, CWE-280
- [Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access Device information.](https://agentprime.io/advisories/CVE-2022-39886.md)
  `CVE-2022-39886` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 9 Nov 2022 · Tags: CWE-280
- [Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacker to access to Device information.](https://agentprime.io/advisories/CVE-2022-39885.md)
  `CVE-2022-39885` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 9 Nov 2022 · Tags: CWE-280
- [Samsung Mobile ShareLive: Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks…](https://agentprime.io/advisories/CVE-2022-39872.md)
  `CVE-2022-39872` · CVE record: Samsung Mobile ShareLive · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2022 · Tags: CWE-280
- [Samsung Mobile Waterplugin: Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin…](https://agentprime.io/advisories/CVE-2022-36874.md)
  `CVE-2022-36874` · CVE record: Samsung Mobile Waterplugin · CVSS 5.9 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-280
- [Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability.](https://agentprime.io/advisories/CVE-2022-34368.md)
  `CVE-2022-34368` · CVE record: Dell NetWorker Management Console · CVSS 6.1 Medium · Not analysed yet · Published 30 Aug 2022 · Tags: CWE-280
- [HYPR Server: Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1…](https://agentprime.io/advisories/CVE-2022-2193.md)
  `CVE-2022-2193` · CVE record: HYPR HYPR Server · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2022 · Tags: CWE-280
- [Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value i…](https://agentprime.io/advisories/CVE-2022-30727.md)
  `CVE-2022-30727` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-280
- [Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of t…](https://agentprime.io/advisories/CVE-2022-30725.md)
  `CVE-2022-30725` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-280
- [Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address…](https://agentprime.io/advisories/CVE-2022-30724.md)
  `CVE-2022-30724` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-280
- [Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC…](https://agentprime.io/advisories/CVE-2022-30723.md)
  `CVE-2022-30723` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-280
- [Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.](https://agentprime.io/advisories/CVE-2022-30716.md)
  `CVE-2022-30716` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Jun 2022 · Tags: CWE-280
- [Missing permissions check in Jenkins Core](https://agentprime.io/advisories/GHSA-59fm-6x3q-q3q5.md)
  `GHSA-59fm-6x3q-q3q5`, `CVE-2016-3725` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.3`, fixed in `2.3` · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2022 · Tags: CWE-280
- [Local Privilege Escalation in ESET product for Windows](https://agentprime.io/advisories/CVE-2021-37851.md)
  `CVE-2021-37851` · CVE record: ESET, spol. s r.o. ESET NOD32 Antivirus and 4 more · CVSS 7.3 High · Not analysed yet · Published 11 May 2022 · Tags: CWE-280
- [Arbitrary File Deletion in ESET products for Windows](https://agentprime.io/advisories/CVE-2022-27167.md)
  `CVE-2022-27167` · CVE record: ESET, spol. s r.o. ESET NOD32 Antivirus and 4 more · CVSS 7.1 High · Not analysed yet · Published 10 May 2022 · Tags: CWE-280
- [Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.](https://agentprime.io/advisories/CVE-2022-22292.md)
  `CVE-2022-22292` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.1 High · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-280
- [Improper privilege handling in Apache Accumulo](https://agentprime.io/advisories/GHSA-grc3-8q8m-4j7c.md)
  `GHSA-grc3-8q8m-4j7c`, `CVE-2020-17533` · Maven `org.apache.accumulo:accumulo-master`: affected `>=1.5.0, <1.10.1 || >=2.0.0, <2.0.1`, fixed in `1.10.1`, `2.0.1` · CVSS 8.1 High · Not analysed yet · Published 9 Feb 2022 · Tags: Broken access control, CWE-252, CWE-280
- [NVIDIA GPU Display Driver: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver…](https://agentprime.io/advisories/CVE-2022-21814.md)
  `CVE-2022-21814` · CVE record: NVIDIA NVIDIA GPU Display Driver · CVSS 6.1 Medium · Not analysed yet · Published 7 Feb 2022 · Tags: CWE-280
- [Improper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java](https://agentprime.io/advisories/GHSA-g76j-4cxx-23h9.md)
  `GHSA-g76j-4cxx-23h9`, `CVE-2022-21363` · Maven `mysql:mysql-connector-java`: affected `<8.0.28`, fixed in `8.0.28` · CVSS 6.6 Medium · Not analysed yet · Published 20 Jan 2022 · Tags: CWE-280
- [Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1)…](https://agentprime.io/advisories/CVE-2021-37175.md)
  `CVE-2021-37175` · CVE record: Siemens RUGGEDCOM ROX MX5000 and 4 more · No CVSS score · Not analysed yet · Published 14 Sept 2021 · Tags: CWE-280
- [Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion](https://agentprime.io/advisories/CVE-2021-38312.md)
  `CVE-2021-38312` · CVE record: Redux.io Gutenberg Template Library & Redux Framework · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2021 · Tags: Broken access control, CWE-280

Newest: <https://agentprime.io/advisories/tag/cwe-280.md>
Older: <https://agentprime.io/advisories/tag/cwe-280.md?cursor=WyIyMDIxLTA5LTAyVDE2OjUzOjM5LjMyODAwMFoiLCJDVkUtMjAyMS0zODMxMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-280&cursor=WyIyMDI0LTA2LTAyVDIyOjI4OjI4LjAwMDAwMFoiLCJHSFNBLXh4Zm0tdm1jZi1nMzNmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-280/?cursor=WyIyMDI0LTA2LTAyVDIyOjI4OjI4LjAwMDAwMFoiLCJHSFNBLXh4Zm0tdm1jZi1nMzNmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.