CWE-281.

Disabled permissions can be granted by Jenkins SSH2 Easy Plugin

• CWE-281

<1.6 · fixed in 1.6

Arbitrary File Overwrite using less command

• Brocade Fabric OS
• CWE-281
• CWE-665

Qemu: 9pfs: suid/sgid bits not dropped on file write

• qemu
• Red Hat Enterprise Linux 6
• CWE-281

Access Control Bypass in Spring Security

• Broken access control
• CWE-281

>=5.6.0, <5.6.12 || >=5.7.0, <5.7.10 || >=5.8.0, <5.8.5 || >=6.0.0, <6.0.5 || >=6.1.0, <6.1.2 · fixed in 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2

User access not updated with privilege change in Tuleap

• Enalean tuleap
• CWE-281

ITM Windows Agent Insecure Filesystem Permissions

• Proofpoint Insider Threat Management
• CWE-281

Trend Micro, Inc. Trend Micro Apex One: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a…

• Trend Micro, Inc. Trend Micro Apex One
• CWE-281

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the…

• Lenovo System Management Module (SMM)
• Lenovo Fan Power Controller (FPC)
• CWE-281

Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile.

• CWE-281

This issue was addressed with improved checks.

• Apple macOS
• Apple watchOS
• CWE-281

A privacy issue was addressed with improved private data redaction for log entries.

• Apple macOS
• Apple watchOS
• CWE-281

A logic issue was addressed with improved state management.

• Apple macOS
• CWE-281

Mozilla Firefox: If temporary "one-time" permissions, such as the ability to use the Camera…

• Mozilla Firefox
• CWE-281

Remote code execution in Voyager

• CWE-281

<=1.4.0 · no fixed version yet

Trellix Agent: A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier…

• Trellix Agent
• CWE-281

Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled

• CWE-281

<587.588.v850a_20a_30162 · fixed in 587.588.v850a_20a_30162

runc AppArmor bypass with symlinked /proc

• Path traversal
• CWE-281

<1.1.5 · fixed in 1.1.5

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

• CWE-281

<1.1.5 · fixed in 1.1.5

App lockout in nextcloud Android app can be bypassed via thirdparty apps

• nextcloud security-advisories
• Authentication bypass
• CWE-281

App pin of the iOS app can be bypassed in Nextcloud iOS

• nextcloud security-advisories
• Authentication bypass
• CWE-281

Delete permissions are not saved when creating public share in Nextcloud server

• nextcloud security-advisories
• CWE-281

Samsung Mobile Samsung Calendar: Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13…

• Samsung Mobile Samsung Calendar
• CWE-281

vantage6 vulnerable to Improper Preservation of Permissions

• CWE-281

<3.8.0 · fixed in 3.8.0

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

• minio
• CWE-281

The bundle management module lacks permission verification in some APIs.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-281

The SystemUI has a vulnerability in permission management.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-281

The IHwAntiMalPlugin interface lacks permission verification.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-281

kernel: An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver…

• kernel
• CWE-281

An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interfa…

• CWE-281

NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to c…

• vGPU software (guest driver) - Linux, NVIDIA Cloud Gaming (guest driver)
• CWE-281

Mozilla Thunderbird: A cross-origin iframe referencing an XSLT document would inherit the parent domain's…

• Mozilla Thunderbird
• Mozilla Firefox ESR
• CWE-281

GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.

• CWE-281

Trellix xAgent permission bypass vulnerability

• Trellix xAgent
• CWE-281

BigBlueButton contains Improper Preservation of Permissions for whiteboard

• bigbluebutton
• CWE-281

NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead t…

• NVIDIA GeForce, Workstation, Compute
• CWE-281

Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN…: Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN…

• Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN
• CWE-281

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

• CWE-281

<0.21.1 · fixed in 0.21.1

The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.

• CWE-281

Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application.

• relatedcode/Messenger
• CWE-281

A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header.

• Business-central
• CWE-281

fhir-works-on-aws-authz-smart handles permissions improperly

• Information disclosure
• CWE-281

>=3.1.1, <3.1.3 · fixed in 3.1.3

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page.

• CWE-281

Shopware access control list bypassed via crafted specific URLs

• CWE-281

<5.7.15 · fixed in 5.7.15

A flaw was found in satellite.

• satellite
• CWE-281

Dell PowerScale OneFS: Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an…

• Dell PowerScale OneFS
• CWE-281

Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

• discourse
• CWE-281

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

• Information disclosure
• CWE-281

>=7.11.0, <7.11.2 || <6.8.15 · fixed in 7.11.2, 6.8.15

Improper Preservation of Permissions in Apache Struts

• CWE-281

>=2.0.0, <2.5.22 · fixed in 2.5.22

Missing permission check in Jenkins Support Core Plugin

• CWE-281

<2.64 · fixed in 2.64

Jython Improper Access Restrictions vulnerability

• CWE-281

<2.7.2b3 · fixed in 2.7.2b3

Smarty Does Not Consider Umask Values When Setting Permissions

• CWE-281

<3.0.0-beta4 · fixed in 3.0.0-beta4

Podman publishes a malicious image to public registries

• Privilege escalation
• CWE-281

<3.4 · fixed in 3.4

Object state limitation has no effect

• CWE-281

>=1.3.0, <1.3.17 · fixed in 1.3.17

Object state limitation has no effect

• CWE-281

>=4.0.0, <4.0.5 || >=4.1.0, <4.1.2 · fixed in 4.0.5, 4.1.2

apicast: A flaw was found in 3Scale APICast in versions prior to 2.11.0…

• apicast
• CWE-281

Dell PowerScale OneFS: Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x…

• Dell PowerScale OneFS
• CWE-281

kernel: An unauthorized access to the execution of the setuid file with capabilities flaw in the…

• kernel
• CWE-281

Missing permission check in Jenkins Continuous Integration with Toad Edge Plugin

• Broken access control
• CWE-281

<2.4 · fixed in 2.4

kernel: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver…

• kernel
• CWE-281

Missing permission checks in Jenkins Release Helper Plugin

• Broken access control
• CWE-281

<=1.3.3 · no fixed version yet