CWE-280.

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail...

• CWE-280
• CWE-755

>=2.0.0, <2.3.0b1 · fixed in 2.3.0b1

Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.

• Veeam Backup & Replication
• CWE-280

JetBrains TeamCity: In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope…

• JetBrains TeamCity
• CWE-280

A downgrade issue was addressed with additional code-signing restrictions.

• Apple macOS
• CWE-280

In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check.

• Google Android
• CWE-280

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

• CWE-280
• CWE-281

>=6.0.0, <6.0.3 · fixed in 6.0.3

Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or sp…

• Privilege escalation
• Broken access control

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL fi…

• CWE-280

Mautic Sensitive Data Exposure due to inadequate user permission settings

• Broken access control
• CWE-280

>=1.0.2, <4.4.12 || >=5.0.0-alpha, <5.0.4 · fixed in 4.4.12, 5.0.4

Matrix IRC Bridge truncated content of messages can be leaked

• CWE-280
• CWE-755

<2.0.0 · fixed in 2.0.0

Improper access control in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Broken access control
• CWE-280

Improper access control in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Broken access control
• CWE-280

there is a possible way to bypass due to a logic error in the code.

• Google Android
• CWE-280

The issue was addressed with improved checks.

• Apple macOS
• CWE-280

Revert password check incorrect type validation

• Zscaler Client Connector
• CWE-280

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.

• CWE-280

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.

• CWE-280

An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive informatio…

• CWE-280

Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions

• Red Hat 3scale API Management Platform 2
• CWE-280

OPPO Usercenter Credit sdk

• OPPO Usercenter Credit sdk
• CWE-280

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.

• Google Android
• CWE-280

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the Support…

• Dell SupportAssist Client Consumer
• CWE-280

Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions

• Broken access control
• CWE-280

>=0.10.4, <0.11.11 · fixed in 0.11.11

Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service.

• Dell Power Manager (DPM)
• CWE-280

Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability

• Insecure deserialization
• CWE-280

<2.13.9.Final || >=3.0.0.Final, <3.2.9.Final · fixed in 2.13.9.Final, 3.2.9.Final

Improper Permission Handling in M-Files Server

• M-Files Server
• CWE-280

Zoom Video Communications, Inc. Zoom Rooms for macOS: Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an…

• Zoom Video Communications, Inc. Zoom Rooms for macOS
• CWE-280

Dell PowerScale OneFS: Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of…

• Dell PowerScale OneFS
• CWE-280

Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability.

• Dell PowerScale OneFS
• CWE-280

Elevation of Privilege in M-Files Desktop Client

• M-Files Client
• CWE-280

Unauthorized scheduling of downtimes via REST API

• Tribe29 Checkmk
• CWE-280

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and da…

• vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
• CWE-280

Apiman vulnerable to permissions bypass due to missing check on API key URL

• Privilege escalation
• Broken access control

<3.1.0.Final · fixed in 3.1.0.Final

`cilium-cli` disables etcd authorization for clustermesh clusters

• CWE-280
• CWE-755

<0.13.2 · fixed in 0.13.2

Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter

• CWE-280

>=2.2.0, <=2.3.1 · no fixed version yet

Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows attacker to access device SIM PIN.

• Samsung Mobile Devices
• CWE-280

wire-server vulnerable to unauthorized removal of Bots from Conversations

• wireapp wire-server
• Broken access control
• CWE-280

Duplicate Advisory: Apiman has insufficient checks for read permissions

• Broken access control
• CWE-280

>=1.5.7, <3.0.0.Final · fixed in 3.0.0.Final

Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to set some setting value in Secure folder.

• Samsung Mobile Devices
• CWE-280

Missing permissions check in Liferay Portal

• Broken access control
• CWE-280

>=7.3.5, <7.4.3.48 · fixed in 7.4.3.48

Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access Device information.

• Samsung Mobile Devices
• CWE-280

Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacker to access to Device information.

• Samsung Mobile Devices
• CWE-280

Samsung Mobile ShareLive: Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks…

• Samsung Mobile ShareLive
• CWE-280

Samsung Mobile Waterplugin: Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin…

• Samsung Mobile Waterplugin
• CWE-280

Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability.

• Dell NetWorker Management Console
• CWE-280

HYPR Server: Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1…

• HYPR Server
• CWE-280

Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value i…

• Samsung Mobile Devices
• CWE-280

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of t…

• Samsung Mobile Devices
• CWE-280

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address…

• Samsung Mobile Devices
• CWE-280

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC…

• Samsung Mobile Devices
• CWE-280

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.

• Samsung Mobile Devices
• CWE-280

Missing permissions check in Jenkins Core

• CWE-280

<2.3 · fixed in 2.3

Local Privilege Escalation in ESET product for Windows

• ESET, spol. s r.o. ESET NOD32 Antivirus
• ESET, spol. s r.o. ESET Internet Security
• CWE-280

Arbitrary File Deletion in ESET products for Windows

• ESET, spol. s r.o. ESET NOD32 Antivirus
• ESET, spol. s r.o. ESET Internet Security
• CWE-280

Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.

• Samsung Mobile Devices
• CWE-280

Improper privilege handling in Apache Accumulo

• Broken access control
• CWE-252

>=1.5.0, <1.10.1 || >=2.0.0, <2.0.1 · fixed in 1.10.1, 2.0.1

NVIDIA GPU Display Driver: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver…

• NVIDIA GPU Display Driver
• CWE-280

Improper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java

• CWE-280

<8.0.28 · fixed in 8.0.28

Siemens RUGGEDCOM ROX MX5000: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1)…

• Siemens RUGGEDCOM ROX MX5000
• Siemens RUGGEDCOM ROX RX1400
• CWE-280

Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion

• Redux.io Gutenberg Template Library & Redux Framework
• Broken access control
• CWE-280