# CWE-281. Every Advisory and CVE whose sources give the weakness CWE-281, newest first. ## Records, newest first (an older page) - [This issue was addressed with improved permissions checking.](https://agentprime.io/advisories/CVE-2025-31184.md) `CVE-2025-31184` · CVE record: Apple Safari and 3 more · CVSS 7.8 High · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2025-30449.md) `CVE-2025-30449` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-281 - [An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function](https://agentprime.io/advisories/CVE-2025-25871.md) `CVE-2025-25871` · CVE record · CVSS 8.0 High · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-281 - [An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the \[/tnexus/rest/admin/updateUser\] API endpoint](https://agentprime.io/advisories/CVE-2025-25711.md) `CVE-2025-25711` · CVE record · CVSS 8.8 High · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-281 - [In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check.](https://agentprime.io/advisories/CVE-2024-56192.md) `CVE-2024-56192` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-281 - [In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow.](https://agentprime.io/advisories/CVE-2024-56191.md) `CVE-2024-56191` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 10 Mar 2025 · Tags: CWE-281 - [Velociraptor Shell Plugin Prevent_execve Bypass](https://agentprime.io/advisories/CVE-2025-0914.md) `CVE-2025-0914` · CVE record: Rapid7 Velociraptor · CVSS 3.8 Low · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-281 - [Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the Process…](https://agentprime.io/advisories/CVE-2024-56973.md) `CVE-2024-56973` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2025 · Tags: CWE-281 - [Potential bypass of chat permissions in Discourse](https://agentprime.io/advisories/CVE-2024-53994.md) `CVE-2024-53994` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: CWE-281 - [Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/adda…](https://agentprime.io/advisories/CVE-2024-53355.md) `CVE-2024-53355` · CVE record · CVSS 8.8 High · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-281 - [snowflake-sdk may incorrectly validate temporary credential cache file permissions](https://agentprime.io/advisories/GHSA-xfhv-wqj6-rx99.md) `GHSA-xfhv-wqj6-rx99`, `CVE-2025-24791` · npm `snowflake-sdk`: affected `>=1.12.0, <2.0.2`, fixed in `2.0.2` · CVSS 4.4 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-281 - [RuoYi vulnerable to Denial of Service by attackers with admin privileges](https://agentprime.io/advisories/GHSA-qq5h-rjj9-q9qg.md) `GHSA-qq5h-rjj9-q9qg`, `CVE-2024-57439` · Maven `com.ruoyi:ruoyi`: affected `<=4.8.0`, no fixed version yet · CVSS 4.9 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-281 - [In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check.](https://agentprime.io/advisories/CVE-2024-40672.md) `CVE-2024-40672` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-281 - [Insecure default config access in WriteFreely in github.com/writefreely/writefreely](https://agentprime.io/advisories/GHSA-3qc3-mx6x-267h.md) `GHSA-3qc3-mx6x-267h`, `CVE-2025-24337`, `GO-2025-3410` · Go `github.com/writefreely/writefreely`: affected `*`, no fixed version yet · CVSS 8.4 High · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-281 - [The issue was addressed with additional permissions checks.](https://agentprime.io/advisories/CVE-2025-24087.md) `CVE-2025-24087` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-281 - [A logic issue was addressed with improved restrictions.](https://agentprime.io/advisories/CVE-2024-54557.md) `CVE-2024-54557` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-54516.md) `CVE-2024-54516` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-281 - [An issue was discovered in Couchbase Server 7.6.x through 7.6.3.](https://agentprime.io/advisories/CVE-2024-56178.md) `CVE-2024-56178` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-281 - [Oracle Corporation Oracle Communications Order and Service…: Vulnerability in the Oracle Communications Order and Service Management product of Oracle…](https://agentprime.io/advisories/CVE-2025-21544.md) `CVE-2025-21544` · CVE record: Oracle Corporation Oracle Communications Order and Service Management · CVSS 5.4 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-281 - [Oracle Corporation Oracle Workflow: Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin…](https://agentprime.io/advisories/CVE-2025-21541.md) `CVE-2025-21541` · CVE record: Oracle Corporation Oracle Workflow · CVSS 5.4 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-281 - [gix-worktree-state nonexclusive checkout sets executable files world-writable](https://agentprime.io/advisories/GHSA-fqmf-w4xh-33rh.md) `GHSA-fqmf-w4xh-33rh`, `CVE-2025-22620`, `RUSTSEC-2025-0001` · crates.io `gix-worktree-state`: affected `>=0.0.0-0, <0.17.0`, fixed in `0.17.0` · CVSS 5.0 Medium · Not analysed yet · Published 18 Jan 2025 · Tags: CWE-281, CWE-687 - [Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint](https://agentprime.io/advisories/CVE-2024-46310.md) `CVE-2024-46310` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-281 - [Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-42231.md) `CVE-2023-42231` · CVE record · CVSS 8.1 High · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-281 - [Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-42228.md) `CVE-2023-42228` · CVE record · CVSS 8.8 High · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-281 - [SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list.](https://agentprime.io/advisories/CVE-2024-54818.md) `CVE-2024-54818` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-281 - [Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups.](https://agentprime.io/advisories/CVE-2024-52869.md) `CVE-2024-52869` · CVE record · CVSS 6.0 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-281 - [SeaCMS V13.1 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2024-54880.md) `CVE-2024-54880` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2025 · Tags: CWE-281 - [SeaCMS V13.1 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2024-54879.md) `CVE-2024-54879` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2025 · Tags: CWE-281 - [The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls…](https://agentprime.io/advisories/CVE-2024-53934.md) `CVE-2024-53934` · CVE record · CVSS 7.7 High · Not analysed yet · Published 6 Jan 2025 · Tags: CWE-281 - [An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arb…](https://agentprime.io/advisories/CVE-2024-46622.md) `CVE-2024-46622` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2025 · Tags: CWE-281 - [An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.](https://agentprime.io/advisories/CVE-2024-55507.md) `CVE-2024-55507` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jan 2025 · Tags: CWE-281 - [This issue was addressed with improved validation of symlinks.](https://agentprime.io/advisories/CVE-2024-44211.md) `CVE-2024-44211` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 20 Dec 2024 · Tags: CWE-281 - [This issue was addressed through improved state management.](https://agentprime.io/advisories/CVE-2024-44223.md) `CVE-2024-44223` · CVE record: Apple macOS · CVSS 4.6 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: CWE-281 - [This issue was addressed with improved validation of the process entitlement and Team ID.](https://agentprime.io/advisories/CVE-2023-42867.md) `CVE-2023-42867` · CVE record: Apple GarageBand · CVSS 7.8 High · Not analysed yet · Published 20 Dec 2024 · Tags: CWE-281 - [Matter: In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0…](https://agentprime.io/advisories/CVE-2024-56317.md) `CVE-2024-56317` · CVE record: Matter Matter · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtain sensitive information via the modification of user cred…](https://agentprime.io/advisories/CVE-2024-37649.md) `CVE-2024-37649` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-281 - [A logic issue was addressed with improved restrictions.](https://agentprime.io/advisories/CVE-2024-54515.md) `CVE-2024-54515` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-281 - [The issue was resolved by sanitizing logging.](https://agentprime.io/advisories/CVE-2024-54484.md) `CVE-2024-54484` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-281 - [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2024-54513.md) `CVE-2024-54513` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-281 - [A logic issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2024-54465.md) `CVE-2024-54465` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-281 - [Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.](https://agentprime.io/advisories/CVE-2024-50931.md) `CVE-2024-50931` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2024-50930.md) `CVE-2024-50930` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS).](https://agentprime.io/advisories/CVE-2024-50929.md) `CVE-2024-50929` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communicatio…](https://agentprime.io/advisories/CVE-2024-50928.md) `CVE-2024-50928` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending cra…](https://agentprime.io/advisories/CVE-2024-50924.md) `CVE-2024-50924` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller.](https://agentprime.io/advisories/CVE-2024-50921.md) `CVE-2024-50921` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.](https://agentprime.io/advisories/CVE-2024-50920.md) `CVE-2024-50920` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d.](https://agentprime.io/advisories/CVE-2024-41650.md) `CVE-2024-41650` · CVE record · CVSS 7.1 High · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread\_.](https://agentprime.io/advisories/CVE-2024-41649.md) `CVE-2024-41649` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_p…](https://agentprime.io/advisories/CVE-2024-41648.md) `CVE-2024-41648` · CVE record · CVSS 7.1 High · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.](https://agentprime.io/advisories/CVE-2024-41646.md) `CVE-2024-41646` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2\_\_amcl.](https://agentprime.io/advisories/CVE-2024-41645.md) `CVE-2024-41645` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler\_ component.](https://agentprime.io/advisories/CVE-2024-41644.md) `CVE-2024-41644` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-281 - [The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted int…](https://agentprime.io/advisories/CVE-2024-37575.md) `CVE-2024-37575` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-281 - [Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs](https://agentprime.io/advisories/GHSA-hh33-46q4-hwm2.md) `GHSA-hh33-46q4-hwm2`, `CVE-2024-43784`, `GO-2024-3291` · Go `github.com/treeverse/lakefs`: affected `<1.33.0`, fixed in `1.33.0` · CVSS 5.7 Medium · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-281 - [Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata](https://agentprime.io/advisories/GHSA-hrxh-9w67-g4cv.md) `GHSA-hrxh-9w67-g4cv`, `BIT-rclone-2024-52522`, `CVE-2024-52522`, `GO-2024-3271` · Go `github.com/rclone/rclone`: affected `>=1.59.0, <1.68.2`, fixed in `1.68.2` · CVSS 5.4 Medium · Not analysed yet · Published 19 Nov 2024 · Tags: Path traversal, CWE-61, CWE-281 - [The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place phone calls without user interaction by…](https://agentprime.io/advisories/CVE-2024-36062.md) `CVE-2024-36062` · CVE record · CVSS 4.0 Medium · Not analysed yet · Published 7 Nov 2024 · Tags: CWE-281 - [Mozilla Firefox: A permission leak could have occurred from a trusted site to an untrusted site via…](https://agentprime.io/advisories/CVE-2024-10458.md) `CVE-2024-10458` · CVE record: Mozilla Firefox and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2024 · Tags: CWE-281 - [A logic issue was addressed with improved restrictions.](https://agentprime.io/advisories/CVE-2024-44193.md) `CVE-2024-44193` · CVE record: Apple iTunes for Windows · CVSS 8.4 High · Not analysed yet · Published 2 Oct 2024 · Tags: CWE-281 - [Permission bypass in M-Files Connector for Copilot](https://agentprime.io/advisories/CVE-2024-9333.md) `CVE-2024-9333` · CVE record: M-Files Corporation M-Files Connector for Copilot · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: CWE-281 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .