CWE-275 · Access Control
Permission Issues
99CVEs
SortMost likely exploited
99 CVEs with CWE-275 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-15379Cisco Prime Infrastructure Arbitrary File Upload and Command Execution VulnerabilityCisco · Cisco Prime Infrastructure · 2018-10-05 | – | 86% | 2018-10-05 |
| CVE-2017-16887The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services can r…Fiberhome · Lm53q1 Firmware · 2018-01-12 | – | 37% | 2018-01-12 |
| CVE-2014-1632htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.Eventum Project · Eventum · 2018-01-31 | – | 10% | 2018-01-31 |
| CVE-2017-17876Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.Iwcnetwork · Shift · 2017-12-26 | – | 9.5% | 2017-12-26 |
| CVE-2014-1631Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.Eventum Project · Eventum · 2018-01-31 | – | 9.3% | 2018-01-31 |
| CVE-2015-7781ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.Zohocorp · Manageengine Firewall Analyzer · 2017-06-27 | – | 7.1% | 2017-06-27 |
| CVE-2014-6047phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.Phpmyfaq · Phpmyfaq · 2018-08-28 | – | 5.7% | 2018-08-28 |
| CVE-2022-0742Memory leak in ICMP6 in Linux KernelLinux · Kernel · CVSS 9.1 · 2022-03-18 | 9.1 | 5.0% | 2022-03-18 |
| CVE-2016-8605The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files…Gnu · Guile · 2017-01-12 | – | 2.8% | 2017-01-12 |
| CVE-2017-11463In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belong…Ivanti · Endpoint Manager · 2017-12-11 | – | 2.4% | 2017-12-11 |
| CVE-2015-7889The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_…Google · Android · 2017-12-27 | – | 2.4% | 2017-12-27 |
| CVE-2016-9461Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checki…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Se… · 2017-03-28 | – | 2.0% | 2017-03-28 |
| CVE-2017-7088An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Exchange ActiveSync" component. It allows remote attackers to erase a device…Apple · Iphone Os · 2017-10-23 | – | 1.9% | 2017-10-23 |
| CVE-2016-9462Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Se… · 2017-03-28 | – | 1.9% | 2017-03-28 |
| CVE-2016-3022IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.IBM Corporation · Access Manager · 2017-02-01 | – | 1.7% | 2017-02-01 |
| CVE-2016-9061A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. Note: This is…Mozilla · Firefox · 2018-06-11 | – | 1.6% | 2018-06-11 |
| CVE-2016-5299A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: This issue only affect…Mozilla · Firefox · 2018-06-11 | – | 1.6% | 2018-06-11 |
| CVE-2017-5809A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.Hewlett Packard Enterprise · Data Protector · 2018-02-15 | – | 1.6% | 2018-02-15 |
| CVE-2016-10818cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).Cpanel · Cpanel · 2019-08-01 | – | 1.6% | 2019-08-01 |
| CVE-2021-1437Cisco Aironet Access Points FlexConnect Upgrade Information Disclosure VulnerabilityCisco · Cisco Aironet Access Point Software · CVSS 7.5 · 2021-03-24 | 7.5 | 1.5% | 2021-03-24 |
| CVE-2016-8520HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permi…Hewlett Packard Enterprise · Helion Eucalyptus · 2018-02-15 | – | 1.4% | 2018-02-15 |
| CVE-2017-7144An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers t…Apple · Safari · 2017-10-23 | – | 1.3% | 2017-10-23 |
| CVE-2016-10846cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).Cpanel · Cpanel · 2019-08-01 | – | 1.3% | 2019-08-01 |
| CVE-2017-6513The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual m…Softaculous · Whmcs Reseller Module · 2017-03-11 | – | 1.3% | 2017-03-11 |
| CVE-2017-9327Secret data of processes managed by CM is not secured by file permissions.Cloudera · Cloudera Manager · 2019-07-03 | – | 1.2% | 2019-07-03 |
| CVE-2017-17060OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.Open-Xchange · Open-Xchange Appsuite · 2019-05-23 | – | 1.2% | 2019-05-23 |
| CVE-2015-5153Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same…Pulp Project · Pulp · 2017-08-18 | – | 1.2% | 2017-08-18 |
| CVE-2016-4873Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.Cybozu · Office · 2017-04-17 | – | 1.2% | 2017-04-17 |
| CVE-2019-2177In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could lead to remote code ex…Google · Android · 2019-09-05 | – | 0.9% | 2019-09-05 |
| CVE-2023-3759Intergard SGS permissionIntergard · SGS · CVSS 6.3 · 2023-07-19 | 6.3 | 0.9% | 2023-07-19 |
| CVE-2023-6302CSZCMS File Manager Page templates permissionCskaza · CSZCMS · CVSS 4.7 · 2023-11-27 | 4.7 | 0.9% | 2023-11-27 |
| CVE-2020-14496Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission IssuesMitsubishi Electric · CPU Module Logging Configuration Tool · CVSS 8.3 · 2022-05-19 | 8.3 | 0.9% | 2022-05-19 |
| CVE-2016-8856Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file permissions could be exploited by attac…Foxitsoftware · Reader · 2016-10-31 | – | 0.8% | 2016-10-31 |
| CVE-2017-1396IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modi…IBM · Security Identity Governance and Intelligence · CVSS 4.2 · 2018-08-06 | 4.2 | 0.8% | 2018-08-06 |
| CVE-2024-3118Dreamer CMS Attachment permissionDreamer · CMS · CVSS 6.3 · 2024-03-31 | 6.3 | 0.8% | 2024-03-31 |
| CVE-2017-7145An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility o…Apple · Iphone Os · 2017-10-23 | – | 0.8% | 2017-10-23 |
| CVE-2023-5263ZZZCMS Database Backup File save.php restore permissionZzzcms · ZZZCMS · CVSS 6.3 · 2023-09-29 | 6.3 | 0.7% | 2023-09-29 |
| CVE-2015-7842Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC6…Huawei · Rh2288 V3 Firmware · 2017-10-09 | – | 0.7% | 2017-10-09 |
| CVE-2013-4201Katello allows remote authenticated users to call the "system remove_deletion" CLI command via vectors related to "remove system" permissions.Katello · Katello · 2018-05-01 | – | 0.7% | 2018-05-01 |
| CVE-2022-22988Insecure file and directory permissions on EdgeRoverWestern Digital · EdgeRover · CVSS 7.7 · 2022-01-13 | 7.7 | 0.7% | 2022-01-13 |
| CVE-2023-6762Thecosy IceCMS Article permissionThecosy · IceCMS · CVSS 5.4 · 2023-12-13 | 5.4 | 0.7% | 2023-12-13 |
| CVE-2017-0884Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching lay…Nextcloud · Nextcloud Server · 2017-04-05 | – | 0.7% | 2017-04-05 |
| CVE-2017-8153Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a maliciou…Huawei Technologies Co., Ltd. · VMall (for Android) · 2017-11-22 | – | 0.6% | 2017-11-22 |
| CVE-2016-7988On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to…Google · Android · 2016-10-31 | – | 0.6% | 2016-10-31 |
| CVE-2016-4288A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions that allows users to e…BlueStacks · App Player · 2017-01-06 | – | 0.6% | 2017-01-06 |
| CVE-2017-0883Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an auth…Nextcloud · Nextcloud Server · 2017-04-05 | – | 0.6% | 2017-04-05 |
| CVE-2016-2406The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encr…Huawei · Document Security Management · 2017-03-20 | – | 0.6% | 2017-03-20 |
| CVE-2016-8732Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communication channel and add…Invincea · Dell Protected Workspace · CVSS 7.8 · 2018-04-24 | 7.8 | 0.6% | 2018-04-24 |
| CVE-2015-8300Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local use…Polycom · Btoe Connector · 2017-08-28 | – | 0.6% | 2017-08-28 |
| CVE-2017-2694The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An attacker can constr…Huawei Technologies Co., Ltd. · HwVmall · 2017-11-22 | – | 0.5% | 2017-11-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.