# CWE-708.

Every Advisory and CVE whose sources give the weakness CWE-708, newest first.

## Records, newest first

- [Nix: The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the…](https://agentprime.io/advisories/CVE-2026-110452.md)
  `CVE-2026-110452` · CVE record: NixOS Nix · CVSS 4.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-708
- [PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership](https://agentprime.io/advisories/CVE-2026-6469.md)
  `CVE-2026-6469` · CVE record: PostgreSQL · CVSS 3.8 Low · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-708
- [HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation](https://agentprime.io/advisories/CVE-2026-40196.md)
  `CVE-2026-40196` · CVE record: sysadminsmedia homebox · CVSS 8.1 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-708
- [Juju affected by timing ownership claim attack on new external back-end secrets](https://agentprime.io/advisories/GHSA-gfgr-6hrj-85ww.md)
  `GHSA-gfgr-6hrj-85ww`, `CVE-2026-32691`, `GO-2026-4769` · Go `github.com/juju/juju`: affected `>=3.0.0, <3.6.19`, fixed in `3.6.19` · CVSS 5.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-708
- [Ubuntu Apport Insecure File Permissions Vulnerability](https://agentprime.io/advisories/CVE-2025-5467.md)
  `CVE-2025-5467` · CVE record: Canonical apport · CVSS 1.9 Low · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-708
- [Jobs can be saved as workflows with wrong permissions on KNIME Business Hub](https://agentprime.io/advisories/CVE-2025-14262.md)
  `CVE-2025-14262` · CVE record: KNIME KNIME Business Hub · CVSS 5.3 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-708
- [Incorrect Ownership Assignment in GitLab](https://agentprime.io/advisories/CVE-2025-5069.md)
  `CVE-2025-5069` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-708
- [Parallels Desktop for Mac: A privilege escalation vulnerability exists in the Snapshot functionality of Parallels…](https://agentprime.io/advisories/CVE-2024-52561.md)
  `CVE-2024-52561` · CVE record: Parallels Parallels Desktop for Mac · CVSS 7.8 High · Not analysed yet · Published 3 Jun 2025 · Tags: CWE-708
- [Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use](https://agentprime.io/advisories/GHSA-wr2m-38xh-rpc9.md)
  `GHSA-wr2m-38xh-rpc9` · crates.io `lemmy_server`: affected `>=0.17.0, <0.19.11`, fixed in `0.19.11` · CVSS 4.0, no score published · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-708
- [Zoom Apps for macOS - Uncontrolled Resource Consumption](https://agentprime.io/advisories/CVE-2024-45417.md)
  `CVE-2024-45417` · CVE record: Zoom Communications, Inc Zoom Apps for macOS · CVSS 6.0 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-708
- [Zoom Workplace Apps - Incorrect Ownership Assignment](https://agentprime.io/advisories/CVE-2024-45426.md)
  `CVE-2024-45426` · CVE record: Zoom Communications, Inc Zoom Workplace Apps · CVSS 4.9 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-708
- [Incorrect Ownership Assignment in GitLab](https://agentprime.io/advisories/CVE-2024-9633.md)
  `CVE-2024-9633` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-708
- [Incorrect file ownership of privileged service's libraries in Enel X JuiceBox](https://agentprime.io/advisories/CVE-2023-29122.md)
  `CVE-2023-29122` · CVE record: Enel X JuiceBox Pro 3.0 22kW Cellular · CVSS 6.7 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-708
- [IBM Global Configuration Management incorrect ownership assignment](https://agentprime.io/advisories/CVE-2024-41773.md)
  `CVE-2024-41773` · CVE record: IBM Global Configuration Management · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-708
- [vantage6 does not properly delete linked resources when deleting a collaboration](https://agentprime.io/advisories/GHSA-rf54-7qrr-96j6.md)
  `GHSA-rf54-7qrr-96j6`, `CVE-2023-41881`, `PYSEC-2023-200` · PyPI `vantage6`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 3.7 Low · Not analysed yet · Published 16 Oct 2023 · Tags: Information disclosure, CWE-708
- [Incorrect Ownership Assignment in GitLab](https://agentprime.io/advisories/CVE-2023-4008.md)
  `CVE-2023-4008` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-708
- [Cisco CX Cloud Agent: A vulnerability in Cisco CX Cloud Agent of could allow an authenticated…](https://agentprime.io/advisories/CVE-2023-20044.md)
  `CVE-2023-20044` · CVE record: Cisco Cisco CX Cloud Agent · CVSS 6.7 Medium · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-708
- [Cisco CX Cloud Agent: A vulnerability in Cisco CX Cloud Agent of could allow an authenticated…](https://agentprime.io/advisories/CVE-2023-20043.md)
  `CVE-2023-20043` · CVE record: Cisco Cisco CX Cloud Agent · CVSS 6.7 Medium · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-708
- [OpenVPN Access Server: The OpenVPN Access Server installer creates a log file readable for everyone…](https://agentprime.io/advisories/CVE-2022-33737.md)
  `CVE-2022-33737` · CVE record: OpenVPN Access Server · No CVSS score · Not analysed yet · Published 6 Jul 2022 · Tags: CWE-708
- [Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication](https://agentprime.io/advisories/CVE-2022-22189.md)
  `CVE-2022-22189` · CVE record: Juniper Networks Contrail Service Orchestration · CVSS 7.3 High · Not analysed yet · Published 14 Apr 2022 · Tags: Authentication bypass, CWE-708
- [Philips MRI 1.5T and 3T Incorrect Ownership Assignment](https://agentprime.io/advisories/CVE-2021-26248.md)
  `CVE-2021-26248` · CVE record: Philips MRI 1.5T and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 19 Nov 2021 · Tags: CWE-708
- [Webauthn tokens not removed after user has been deleted](https://agentprime.io/advisories/CVE-2021-32726.md)
  `CVE-2021-32726` · CVE record: nextcloud security-advisories · CVSS 7.1 High · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-708
- [Nextcloud Talk not properly disassociating users from chats after account deletion](https://agentprime.io/advisories/CVE-2021-32689.md)
  `CVE-2021-32689` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 12 Jul 2021 · Tags: Information disclosure, CWE-708

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-708>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-708/>. Everything for agents: <https://agentprime.io/llms.txt>.