CWE-280.

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges

• CWE-280

Insufficient permission validation when showing agent information

• Checkmk
• CWE-280

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-280

TCG2 TPM RT Not Locked Issue

• AMI AptioV
• CWE-280

Insufficient permission validation on multiple REST API endpoints

• Checkmk
• CWE-280

Insufficient permission validation when configuring notification parameters

• Checkmk
• CWE-280

GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR

• Imagination Technologies Graphics DDK
• CWE-280

FileRise insecure folder visibility via name-based mapping and incomplete ACL checks

• error311 FileRise
• Broken access control
• CWE-280

FileRise improper ownership/permission validation allowed cross-tenant file operations

• error311 FileRise
• Broken access control
• CWE-280

Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels

• mastodon
• CWE-280

Dell Repository Manager (DRM): Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8…

• Dell Repository Manager (DRM)
• CWE-280

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

• CWE-280

>=3.9.0, <3.9.4 · fixed in 3.9.4

Tuleap backlog item representations do not verify the permissions of the child trackers

• Enalean tuleap
• CWE-280

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-280

GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite

• Imagination Technologies Graphics DDK
• CWE-280

GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation

• Imagination Technologies Graphics DDK
• CWE-280

Microsoft Teams Elevation of Privilege Vulnerability

• Microsoft Teams for Android
• Microsoft Teams for Desktop
• CWE-280

Improper File Access in Infinera G42

• Infinera G42
• CWE-280

Improper File Access in Infinera G42

• Infinera G42
• CWE-280

GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs

• Imagination Technologies Graphics DDK
• CWE-280

Fortinet FortiPAM: A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0…

• Fortinet FortiPAM
• Fortinet FortiSRA
• CWE-280

GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

• Imagination Technologies Graphics DDK
• CWE-280

Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil

• CWE-280

* · no fixed version yet

Microsoft Dataverse Elevation of Privilege Vulnerability

• Microsoft Dataverse
• CWE-280

The issue was addressed with additional permissions checks.

• Apple macOS
• CWE-280

Improper Handling of Insufficient Permissions

• Schweitzer Engineering Laboratories SEL Blueframe OS
• CWE-280

Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-280

Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-280

Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-280

GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)

• Imagination Technologies Graphics DDK
• CWE-280

Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

• appsmith
• CWE-280

Improper Handling of Insufficient Permissions or Privileges in B&R APROL

• B&R Industrial Automation B&R APROL
• CWE-280

GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object

• Imagination Technologies Graphics DDK
• CWE-280

IBM InfoSphere Server Information command execution

• IBM InfoSphere Information Server
• CWE-280

Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-280

In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check.

• MediaTek, Inc. MT6880, MT6890, MT6980, MT6990, MT7663, MT7902, MT7925, MT7927, MT7961
• CWE-280

Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges

• Hitachi Vantara Pentaho Data Integration & Analytics
• Hitachi Vantara Pentaho Business Analytics Server
• CWE-280

Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap

• Enalean tuleap
• CWE-280

Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

• Enalean tuleap
• CWE-280

An attacker who successfully exploited these vulnerabilities could cause enable command execution.

• ABB AC500 V3
• CWE-280

Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability.

• Dell Update Package (DUP) Framework
• CWE-280

GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)

• Imagination Technologies Graphics DDK
• CWE-280

HCL BigFix Inventory is affected by an access control vulnerability

• HCL Software BigFix Inventory
• CWE-280

Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges

• Ruijie Reyee OS
• CWE-280

GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages

• Imagination Technologies Graphics DDK
• CWE-280

Multiple missing permission checks

• OpenText Application Automation Tools
• CWE-280

Multiple missing permission checks

• OpenText Application Automation Tools
• CWE-280

Tuleap lists trackers in the quick add actions of the backlog without any permissions check

• Enalean tuleap
• CWE-280

Permissions are incorrectly verified for project administrators in the cross tracker search widget

• Enalean tuleap
• CWE-280

Tuleap does not properly check permissions for email notifications in trackers

• Enalean tuleap
• CWE-280

An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.

• CWE-280

PLANET Technology switch devices - SSH server DoS attack

• PLANET Technology GS-4210-24PL4C hardware 2.0
• PLANET Technology GS-4210-24P2S hardware 3.0
• Denial of service
• CWE-280

usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos

• CWE-280

<0.9.1 · fixed in 0.9.1

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload

• reputeinfosystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
• CWE-280

Webmin: Improper handling of insufficient permissions or privileges vulnerability exists in…

• Webmin
• CWE-280

Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

• CWE-280
• CWE-755

<2.0.1 · fixed in 2.0.1

Improper Handling of Insufficient Permissions or Privileges in Conduit

• Conduit
• CWE-280

Improper permission settings in com.transsion.carlcare

• TECNO com.transsion.carlcare
• Broken access control
• CWE-280

Salon booking system <= 9.9 - Missing Authorization

• wordpresschef Salon Booking System – Free Version
• CWE-280

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

• CWE-280

>=6.0.0, <6.0.5 || >=6.1.0, <6.1.2 · fixed in 6.0.5, 6.1.2