# CWE-281. Every Advisory and CVE whose sources give the weakness CWE-281, newest first. ## Records, newest first (an older page) - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-44149.md) `CVE-2024-44149` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-40859.md) `CVE-2024-40859` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-27858.md) `CVE-2024-27858` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-40831.md) `CVE-2024-40831` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-44188.md) `CVE-2024-44188` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-27795.md) `CVE-2024-27795` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2024 · Tags: CWE-281 - [Access control flaw in Kiali in github.com/kiali/kiali](https://agentprime.io/advisories/GHSA-mv55-23xp-3wp8.md) `GHSA-mv55-23xp-3wp8`, `CVE-2021-3495`, `GO-2022-0645` · Go `github.com/kiali/kiali`: affected `<1.33.0`, fixed in `1.33.0` · No CVSS score · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-281 - [Improper Preservation of Permissions in xxl-job](https://agentprime.io/advisories/GHSA-cpfp-m5qw-c4r3.md) `GHSA-cpfp-m5qw-c4r3`, `CVE-2024-42681` · Maven `com.xuxueli:xxl-job-core`: affected `<2.4.2`, fixed in `2.4.2` · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2024 · Tags: Broken access control, CWE-277, CWE-281 - [System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission](https://agentprime.io/advisories/CVE-2024-22114.md) `CVE-2024-22114` · CVE record: Zabbix Zabbix · CVSS 4.3 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: CWE-281 - [Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe](https://agentprime.io/advisories/CVE-2024-22121.md) `CVE-2024-22121` · CVE record: Zabbix Zabbix · CVSS 6.1 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: CWE-281 - [Zscaler bypass with administrative privileges on Windows](https://agentprime.io/advisories/CVE-2024-23464.md) `CVE-2024-23464` · CVE record: Zscaler Client Connector · CVSS 7.2 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies.](https://agentprime.io/advisories/CVE-2024-33892.md) `CVE-2024-33892` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: CWE-281 - [A permissions issue was addressed by removing vulnerable code and adding additional checks.](https://agentprime.io/advisories/CVE-2024-27888.md) `CVE-2024-27888` · CVE record: Apple macOS · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-40805.md) `CVE-2024-40805` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.7 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [The issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2024-40828.md) `CVE-2024-40828` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [This issue was addressed through improved state management.](https://agentprime.io/advisories/CVE-2024-40824.md) `CVE-2024-40824` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.7 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [An access issue was addressed with additional sandbox restrictions.](https://agentprime.io/advisories/CVE-2024-40821.md) `CVE-2024-40821` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [An input validation issue was addressed with improved input validation.](https://agentprime.io/advisories/CVE-2024-40800.md) `CVE-2024-40800` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [The issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2024-40811.md) `CVE-2024-40811` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 29 Jul 2024 · Tags: CWE-281 - [Tuleap's recursive permissions to document manager folder are not properly applied](https://agentprime.io/advisories/CVE-2024-39902.md) `CVE-2024-39902` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-281 - [HP Inc. HP Display Control: Potential vulnerabilities have been identified in the HP Display Control software…](https://agentprime.io/advisories/CVE-2024-29080.md) `CVE-2024-29080` · CVE record: HP Inc. HP Display Control · CVSS 6.5 Medium · Not analysed yet · Published 19 Jul 2024 · Tags: CWE-281 - [File Permission Vulnerability in Hitachi Ops Center Common Services](https://agentprime.io/advisories/CVE-2024-2819.md) `CVE-2024-2819` · CVE record: Hitachi Hitachi Ops Center Common Services · CVSS 5.1 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: Broken access control, CWE-281 - [Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.](https://agentprime.io/advisories/CVE-2024-36532.md) `CVE-2024-36532` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jun 2024 · Tags: CWE-281 - [SpiceDB exclusions can result in no permission returned when permission expected](https://agentprime.io/advisories/GHSA-grjv-gjgr-66g2.md) `GHSA-grjv-gjgr-66g2`, `CVE-2024-38361`, `GO-2024-2939` · Go `github.com/authzed/spicedb`: affected `<1.33.1`, fixed in `1.33.1` · CVSS 3.7 Low · Not analysed yet · Published 20 Jun 2024 · Tags: CWE-281 - [Permission and Access Control Vulnerability in ZTE H388X](https://agentprime.io/advisories/CVE-2023-25646.md) `CVE-2023-25646` · CVE record: ZTE ZXHN H388X · CVSS 7.1 High · Not analysed yet · Published 20 Jun 2024 · Tags: CWE-281 - [\`docker cp\` allows unexpected chmod of host files in Moby Docker Engine](https://agentprime.io/advisories/GHSA-v994-f8vw-g7j4.md) `GHSA-v994-f8vw-g7j4`, `CVE-2021-41089`, `GO-2024-2913` · Go `github.com/docker/docker`: affected `<20.10.9`, fixed in `20.10.9` · CVSS 2.8 Low · Not analysed yet · Published 10 Jun 2024 · Tags: CWE-281 - [Privilege Escalation](https://agentprime.io/advisories/CVE-2024-3291.md) `CVE-2024-3291` · CVE record: Tenable Nessus Agent · CVSS 7.8 High · Not analysed yet · Published 17 May 2024 · Tags: CWE-281 - [Tenable Nessus: When installing Nessus to a directory outside of the default location on a Windows host…](https://agentprime.io/advisories/CVE-2024-3289.md) `CVE-2024-3289` · CVE record: Tenable Nessus · CVSS 7.8 High · Not analysed yet · Published 17 May 2024 · Tags: CWE-281 - [Grafana folders admin only permission privilege escalation](https://agentprime.io/advisories/GHSA-p978-56hq-r492.md) `GHSA-p978-56hq-r492`, `BIT-grafana-2022-36062`, `CVE-2022-36062`, `GO-2024-2854` · Go `github.com/grafana/grafana`: affected `>=8.5.0, <8.5.13 || >=9.0.0, <9.0.9 || >=9.1.0, <9.1.6`, fixed in `8.5.13`, `9.0.9`, `9.1.6` · CVSS 7.6 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-281 - [Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will](https://agentprime.io/advisories/CVE-2024-32020.md) `CVE-2024-32020` · CVE record: git git · CVSS 3.9 Low · Not analysed yet · Published 14 May 2024 · Tags: CWE-281 - [Mozilla Firefox: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to…](https://agentprime.io/advisories/CVE-2024-4768.md) `CVE-2024-4768` · CVE record: Mozilla Firefox and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-281 - [WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2024-33921.md) `CVE-2024-33921` · CVE record: ReviewX ReviewX · CVSS 4.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: CWE-281 - [Wagtail has permission check bypass when editing a model with per-field restrictions through \`wagtail.contrib.settings\` or \`ModelViewSet\`](https://agentprime.io/advisories/GHSA-w2v8-php4-p8hc.md) `GHSA-w2v8-php4-p8hc`, `CVE-2024-32882`, `PYSEC-2026-2031` · PyPI `wagtail`: affected `>=6.0.0, <6.0.3`, fixed in `6.0.3` · CVSS 2.7 Low · Not analysed yet · Published 1 May 2024 · Tags: CWE-280, CWE-281 - [XADMaster may not apply quarantine attribute correctly to extracted files](https://agentprime.io/advisories/CVE-2024-22405.md) `CVE-2024-22405` · CVE record: MacPaw XADMaster · CVSS 5.5 Medium · Not analysed yet · Published 30 Apr 2024 · Tags: CWE-281 - [Quarkus: security checks in resteasy reactive may trigger a denial of service](https://agentprime.io/advisories/GHSA-mv64-86g8-cqq7.md) `GHSA-mv64-86g8-cqq7`, `CVE-2024-1726` · Maven `io.quarkus.resteasy.reactive:resteasy-reactive`: affected `>=3.8.0.CR1, <3.8.0 || >=3.3.0.CR1, <3.7.4 || <3.2.11.Final`, fixed in `3.8.0`, `3.7.4`, `3.2.11.Final` · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: CWE-281 - [HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type](https://agentprime.io/advisories/CVE-2024-23560.md) `CVE-2024-23560` · CVE record: HCL Software DevOps Deploy / Launch · CVSS 4.4 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: CWE-281 - [Devolutions Server: Improper permission handling in the vault offline cache feature in Devolutions Remote…](https://agentprime.io/advisories/CVE-2024-3545.md) `CVE-2024-3545` · CVE record: Devolutions Server and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-281 - [Permission verification vulnerability in the system module.](https://agentprime.io/advisories/CVE-2023-52542.md) `CVE-2023-52542` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2024 · Tags: CWE-281 - [Audio has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2024-22177.md) `CVE-2024-22177` · CVE record: OpenHarmony OpenHarmony · CVSS 3.3 Low · Not analysed yet · Published 2 Apr 2024 · Tags: CWE-281 - [Apache Airflow Improper Preservation of Permissions vulnerability](https://agentprime.io/advisories/GHSA-cff3-5qrp-hqx7.md) `GHSA-cff3-5qrp-hqx7`, `BIT-airflow-2024-29735`, `CVE-2024-29735`, `PYSEC-2026-1132` · PyPI `apache-airflow`: affected `>=2.8.2, <2.8.4`, fixed in `2.8.4` · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2024 · Tags: CWE-281 - [Anope before 2.0.15 does not prevent resetting the password of a suspended account.](https://agentprime.io/advisories/CVE-2024-30187.md) `CVE-2024-30187` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: CWE-281 - [Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI whic...](https://agentprime.io/advisories/GHSA-h574-6646-vfxx.md) `GHSA-h574-6646-vfxx`, `BIT-airflow-2024-28746`, `CVE-2024-28746`, `PYSEC-2024-46` · PyPI `apache-airflow`: affected `>=2.8.0, <2.8.3rc1`, fixed in `2.8.3rc1` · CVSS 8.1 High · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-281 - [Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests](https://agentprime.io/advisories/GHSA-m4rm-x2rr-357w.md) `GHSA-m4rm-x2rr-357w`, `CVE-2024-28152` · Maven `org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source`: affected `<871.v28d74e8b_4226`, fixed in `871.v28d74e8b_4226` · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-281 - [Background task manager has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2024-21816.md) `CVE-2024-21816` · CVE record: OpenHarmony OpenHarmony · CVSS 4.0 Medium · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-281 - [An issue was discovered in Couchbase Server before 7.2.4.](https://agentprime.io/advisories/CVE-2023-49932.md) `CVE-2023-49932` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: CWE-281 - [Missing permission checks on Hazelcast client protocol](https://agentprime.io/advisories/GHSA-xh6m-7cr7-xx66.md) `GHSA-xh6m-7cr7-xx66`, `CVE-2023-45859` · Maven `com.hazelcast:hazelcast` and 1 more: affected `<=4.1.10 || >=4.2, <=4.2.8 || >=5.0, <=5.0.5 || >=5.1, <=5.1.7 || >=5.2.0, <5.2.5 || >=5.3.0, <5.3.5`, fixed in `5.2.5`, `5.3.5` · CVSS 7.6 High · Not analysed yet · Published 27 Feb 2024 · Tags: Information disclosure, CWE-281 - [Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.](https://agentprime.io/advisories/CVE-2023-52373.md) `CVE-2023-52373` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 18 Feb 2024 · Tags: CWE-281 - [Moby (Docker Engine) Insufficiently restricted permissions on data directory](https://agentprime.io/advisories/GHSA-3fwx-pjgw-3558.md) `GHSA-3fwx-pjgw-3558`, `CVE-2021-41091`, `GO-2024-2500` · Go `github.com/docker/docker` and 1 more: affected `<20.10.9`, fixed in `20.10.9` · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2024 · Tags: Broken access control, CWE-281 - [Improper Preservation of Permissions in etcd](https://agentprime.io/advisories/GHSA-chh6-ppwq-jh92.md) `GHSA-chh6-ppwq-jh92`, `BIT-etcd-2020-15113`, `CVE-2020-15113` · Go `github.com/etcd-io/etcd`: affected `<3.3.23 || >=3.4.0-rc.0, <3.4.10`, fixed in `3.3.23`, `3.4.10` · CVSS 5.7 Medium · Not analysed yet · Published 30 Jan 2024 · Tags: CWE-281 - [Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist](https://agentprime.io/advisories/CVE-2024-22402.md) `CVE-2024-22402` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [All users can reset the allowed apps list for Nextcloud Guest App users](https://agentprime.io/advisories/CVE-2024-22401.md) `CVE-2024-22401` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [Permissions bypass in Nextcloud with the files zip app](https://agentprime.io/advisories/CVE-2024-22404.md) `CVE-2024-22404` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.](https://agentprime.io/advisories/CVE-2023-47463.md) `CVE-2023-47463` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Nov 2023 · Tags: CWE-281 - [Incorrect calculation of effective permissions](https://agentprime.io/advisories/CVE-2023-6239.md) `CVE-2023-6239` · CVE record: M-Files M-Files Server · CVSS 5.4 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-281 - [Cookies are sent to external images in rendered diff (and server side request forgery)](https://agentprime.io/advisories/GHSA-7rfg-6273-f5wp.md) `GHSA-7rfg-6273-f5wp`, `CVE-2023-48240` · Maven `org.xwiki.platform:xwiki-platform-diff-xml`: affected `>=11.10.1, <14.10.15 || >=15.0-rc-1, <15.5.1 || >=15.6-rc-1, <15.6`, fixed in `14.10.15`, `15.5.1`, `15.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Nov 2023 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-281 - [Hiview has an improper preservation of permissions vulnerability](https://agentprime.io/advisories/CVE-2023-43612.md) `CVE-2023-43612` · CVE record: OpenHarmony OpenHarmony · CVSS 8.4 High · Not analysed yet · Published 20 Nov 2023 · Tags: CWE-281 - [Local privilege escalation](https://agentprime.io/advisories/CVE-2023-4996.md) `CVE-2023-4996` · CVE record: Netskope Netskope Client · CVSS 6.6 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: CWE-281 - [SaToken privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-54f6-9mx9-86f7.md) `GHSA-54f6-9mx9-86f7`, `CVE-2023-44794` · Maven `cn.dev33:sa-token-core`: affected `<1.37.0`, fixed in `1.37.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Broken access control, CWE-281 - [OpenSearch Issue with tenant read-only permissions](https://agentprime.io/advisories/GHSA-72q2-gwwf-6hrv.md) `GHSA-72q2-gwwf-6hrv`, `CVE-2023-45807` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=2.0.0.0, <2.11.0.0 || <1.3.14.0`, fixed in `2.11.0.0`, `1.3.14.0` · CVSS 5.4 Medium · Not analysed yet · Published 17 Oct 2023 · Tags: CWE-281 - [Apache Superset has improper default REST API permission for Gamma users](https://agentprime.io/advisories/GHSA-9832-mgg4-3gr6.md) `GHSA-9832-mgg4-3gr6`, `BIT-superset-2023-36387`, `CVE-2023-36387`, `PYSEC-2026-1168` · PyPI `apache-superset`: affected `<=2.1.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 6 Sept 2023 · Tags: Broken access control, Server-side request forgery (SSRF), CWE-281 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .