CWE-281.

This issue was addressed with improved permissions checking.

• Apple Safari
• Apple iOS and iPadOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function

• CWE-281

An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint

• CWE-281

In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check.

• Google Android
• CWE-281

In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow.

• Google Android
• CWE-281

Velociraptor Shell Plugin Prevent_execve Bypass

• Rapid7 Velociraptor
• CWE-281

Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the Process…

• CWE-281

Potential bypass of chat permissions in Discourse

• discourse
• CWE-281

Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/adda…

• CWE-281

snowflake-sdk may incorrectly validate temporary credential cache file permissions

• CWE-281

>=1.12.0, <2.0.2 · fixed in 2.0.2

RuoYi vulnerable to Denial of Service by attackers with admin privileges

• CWE-281

<=4.8.0 · no fixed version yet

In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check.

• Google Android
• CWE-281

Insecure default config access in WriteFreely in github.com/writefreely/writefreely

• CWE-281

* · no fixed version yet

The issue was addressed with additional permissions checks.

• Apple macOS
• CWE-281

A logic issue was addressed with improved restrictions.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-281

An issue was discovered in Couchbase Server 7.6.x through 7.6.3.

• CWE-281

Oracle Corporation Oracle Communications Order and Service…: Vulnerability in the Oracle Communications Order and Service Management product of Oracle…

• Oracle Corporation Oracle Communications Order and Service Management
• CWE-281

Oracle Corporation Oracle Workflow: Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin…

• Oracle Corporation Oracle Workflow
• CWE-281

gix-worktree-state nonexclusive checkout sets executable files world-writable

• CWE-281
• CWE-687

>=0.0.0-0, <0.17.0 · fixed in 0.17.0

Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint

• CWE-281

Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.

• CWE-281

Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.

• CWE-281

SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list.

• CWE-281

Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups.

• CWE-281

SeaCMS V13.1 is vulnerable to Incorrect Access Control.

• CWE-281

SeaCMS V13.1 is vulnerable to Incorrect Access Control.

• CWE-281

The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls…

• CWE-281

An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arb…

• CWE-281

An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.

• CWE-281

This issue was addressed with improved validation of symlinks.

• Apple macOS
• CWE-281

This issue was addressed through improved state management.

• Apple macOS
• CWE-281

This issue was addressed with improved validation of the process entitlement and Team ID.

• Apple GarageBand
• CWE-281

Matter: In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0…

• Matter
• CWE-281

Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtain sensitive information via the modification of user cred…

• CWE-281

A logic issue was addressed with improved restrictions.

• Apple macOS
• CWE-281

The issue was resolved by sanitizing logging.

• Apple macOS
• CWE-281

A permissions issue was addressed with additional restrictions.

• Apple iOS and iPadOS
• Apple macOS
• CWE-281

A logic issue was addressed with improved state management.

• Apple macOS
• CWE-281

Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.

• CWE-281

An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.

• CWE-281

Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS).

• CWE-281

Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communicatio…

• CWE-281

Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending cra…

• CWE-281

Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller.

• CWE-281

Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d.

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread_.

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_p…

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.

• CWE-281

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.

• CWE-281

The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted int…

• CWE-281

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

• CWE-281

<1.33.0 · fixed in 1.33.0

Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

• Path traversal
• CWE-61

>=1.59.0, <1.68.2 · fixed in 1.68.2

The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place phone calls without user interaction by…

• CWE-281

Mozilla Firefox: A permission leak could have occurred from a trusted site to an untrusted site via…

• Mozilla Firefox
• Mozilla Firefox ESR
• CWE-281

A logic issue was addressed with improved restrictions.

• Apple iTunes for Windows
• CWE-281

Permission bypass in M-Files Connector for Copilot

• M-Files Corporation M-Files Connector for Copilot
• CWE-281