CWE-281.

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

Access control flaw in Kiali in github.com/kiali/kiali

• CWE-281

<1.33.0 · fixed in 1.33.0

Improper Preservation of Permissions in xxl-job

• Broken access control
• CWE-277

<2.4.2 · fixed in 2.4.2

System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission

• Zabbix
• CWE-281

Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

• Zabbix
• CWE-281

Zscaler bypass with administrative privileges on Windows

• Zscaler Client Connector
• CWE-281

Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies.

• CWE-281

A permissions issue was addressed by removing vulnerable code and adding additional checks.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple iOS and iPadOS
• Apple macOS
• CWE-281

The issue was addressed with improved checks.

• Apple macOS
• CWE-281

This issue was addressed through improved state management.

• Apple iOS and iPadOS
• Apple macOS
• CWE-281

An access issue was addressed with additional sandbox restrictions.

• Apple macOS
• CWE-281

An input validation issue was addressed with improved input validation.

• Apple macOS
• CWE-281

The issue was addressed with improved checks.

• Apple macOS
• CWE-281

Tuleap's recursive permissions to document manager folder are not properly applied

• Enalean tuleap
• CWE-281

HP Inc. HP Display Control: Potential vulnerabilities have been identified in the HP Display Control software…

• HP Inc. HP Display Control
• CWE-281

File Permission Vulnerability in Hitachi Ops Center Common Services

• Hitachi Ops Center Common Services
• Broken access control
• CWE-281

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

• CWE-281

SpiceDB exclusions can result in no permission returned when permission expected

• CWE-281

<1.33.1 · fixed in 1.33.1

Permission and Access Control Vulnerability in ZTE H388X

• ZTE ZXHN H388X
• CWE-281

`docker cp` allows unexpected chmod of host files in Moby Docker Engine

• CWE-281

<20.10.9 · fixed in 20.10.9

Privilege Escalation

• Tenable Nessus Agent
• CWE-281

Tenable Nessus: When installing Nessus to a directory outside of the default location on a Windows host…

• Tenable Nessus
• CWE-281

Grafana folders admin only permission privilege escalation

• CWE-281

>=8.5.0, <8.5.13 || >=9.0.0, <9.0.9 || >=9.1.0, <9.1.6 · fixed in 8.5.13, 9.0.9, 9.1.6

Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will

• git
• CWE-281

Mozilla Firefox: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to…

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-281

WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability

• ReviewX
• CWE-281

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

• CWE-280
• CWE-281

>=6.0.0, <6.0.3 · fixed in 6.0.3

XADMaster may not apply quarantine attribute correctly to extracted files

• MacPaw XADMaster
• CWE-281

Quarkus: security checks in resteasy reactive may trigger a denial of service

• CWE-281

>=3.8.0.CR1, <3.8.0 || >=3.3.0.CR1, <3.7.4 || <3.2.11.Final · fixed in 3.8.0, 3.7.4, 3.2.11.Final

HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type

• HCL Software DevOps Deploy / Launch
• CWE-281

Devolutions Server: Improper permission handling in the vault offline cache feature in Devolutions Remote…

• Devolutions Server
• Devolutions Remote Desktop Manager
• CWE-281

Permission verification vulnerability in the system module.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-281

Audio has an improper preservation of permissions vulnerability

• OpenHarmony
• CWE-281

Apache Airflow Improper Preservation of Permissions vulnerability

• CWE-281

>=2.8.2, <2.8.4 · fixed in 2.8.4

Anope before 2.0.15 does not prevent resetting the password of a suspended account.

• CWE-281

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI whic...

• CWE-281

>=2.8.0, <2.8.3rc1 · fixed in 2.8.3rc1

Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests

• CWE-281

<871.v28d74e8b_4226 · fixed in 871.v28d74e8b_4226

Background task manager has an improper preservation of permissions vulnerability

• OpenHarmony
• CWE-281

An issue was discovered in Couchbase Server before 7.2.4.

• CWE-281

Missing permission checks on Hazelcast client protocol

• Information disclosure
• CWE-281

<=4.1.10 || >=4.2, <=4.2.8 || >=5.0, <=5.0.5 || >=5.1, <=5.1.7 || >=5.2.0, <5.2.5 || >=5.3.0, <5.3.5 · fixed in 5.2.5, 5.3.5

Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-281

Moby (Docker Engine) Insufficiently restricted permissions on data directory

• Broken access control
• CWE-281

<20.10.9 · fixed in 20.10.9

Improper Preservation of Permissions in etcd

• CWE-281

<3.3.23 || >=3.4.0-rc.0, <3.4.10 · fixed in 3.3.23, 3.4.10

Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

• nextcloud security-advisories
• CWE-281

All users can reset the allowed apps list for Nextcloud Guest App users

• nextcloud security-advisories
• CWE-281

Permissions bypass in Nextcloud with the files zip app

• nextcloud security-advisories
• CWE-281

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.

• CWE-281

Incorrect calculation of effective permissions

• M-Files Server
• CWE-281

Cookies are sent to external images in rendered diff (and server side request forgery)

• Information disclosure
• Server-side request forgery (SSRF)

>=11.10.1, <14.10.15 || >=15.0-rc-1, <15.5.1 || >=15.6-rc-1, <15.6 · fixed in 14.10.15, 15.5.1, 15.6

Hiview has an improper preservation of permissions vulnerability

• OpenHarmony
• CWE-281

Local privilege escalation

• Netskope Client
• CWE-281

SaToken privilege escalation vulnerability

• Broken access control
• CWE-281

<1.37.0 · fixed in 1.37.0

OpenSearch Issue with tenant read-only permissions

• CWE-281

>=2.0.0.0, <2.11.0.0 || <1.3.14.0 · fixed in 2.11.0.0, 1.3.14.0

Apache Superset has improper default REST API permission for Gamma users

• Broken access control
• Server-side request forgery (SSRF)

<=2.1.0 · no fixed version yet