CWE-277 · Access Control
Insecure Inherited Permissions
70CVEs
SortMost likely exploited
70 CVEs with CWE-277 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-27842Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenentExtplorer · Extplorer · CVSS 8.8 · 2023-03-21 | 8.8 | 2.4% | 2023-03-21 |
| CVE-2021-41170Evaluation of closures can lead to execution of methods & functions in current program scopesroehrl · neoan3-template · CVSS 9.8 · 2021-11-08 | 9.8 | 1.6% | 2021-11-08 |
| CVE-2024-27822A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges.Apple · macOS · CVSS 7.4 · 2024-05-13 | 7.4 | 1.5% | 2024-05-13 |
| CVE-2024-36539Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.Projectcontour · Contour · CVSS 9.8 · 2024-07-24 | 9.8 | 1.3% | 2024-07-24 |
| CVE-2021-32725Default share permissions not respected for federated resharesnextcloud · security-advisories · CVSS 3.5 · 2021-07-12 | 3.5 | 1.2% | 2021-07-12 |
| CVE-2024-42681Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.Xuxueli · Xxl-Job · CVSS 8.8 · 2024-08-15 | 8.8 | 0.9% | 2024-08-15 |
| CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objectsRed Hat · Red Hat Ansible Automation Platform 2 · CVSS 6.7 · 2024-08-07 | 6.7 | 0.6% | 2024-08-07 |
| CVE-2024-34329Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as…No vendor recorded · CVSS 8.4 · 2024-07-22 | 8.4 | 0.6% | 2024-07-22 |
| CVE-2025-37174Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) · ArubaOS (AOS) · CVSS 7.2 · 2026-01-13 | 7.2 | 0.6% | 2026-01-13 |
| CVE-2019-5068An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any spe…Mesa3d · Mesa 3D X11 Graphics library · CVSS 5.1 · 2019-11-05 | 5.1 | 0.5% | 2019-11-05 |
| CVE-2024-36542Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.No vendor recorded · CVSS 8.8 · 2024-07-25 | 8.8 | 0.5% | 2024-07-25 |
| CVE-2021-24031In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at compl…Facebook · Zstandard · 2021-03-04 | – | 0.5% | 2021-03-04 |
| CVE-2024-41601Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.No vendor recorded · CVSS 7.5 · 2024-07-19 | 7.5 | 0.5% | 2024-07-19 |
| CVE-2025-11395Podman: arbitrary file write when importing oci archiveRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.5 · 2026-09-15 | 5.5 | 0.4% | 2026-09-15 |
| CVE-2024-36540Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.External-Secrets · External Secrets Operator · CVSS 9.8 · 2024-07-24 | 9.8 | 0.4% | 2024-07-24 |
| CVE-2025-11554Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissionsPortabilis · i-Educar · CVSS 6.3 · 2025-10-09 | 6.3 | 0.4% | 2025-10-09 |
| CVE-2024-6605Firefox Android missed activation delay to prevent tapjackingMozilla · Firefox · CVSS 8.8 · 2024-07-09 | 8.8 | 0.4% | 2024-07-09 |
| CVE-2021-24032Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restrict…Facebook · Zstandard · 2021-03-04 | – | 0.3% | 2021-03-04 |
| CVE-2025-56019An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy (BLE) wi…Agasta · Easy Touch Plus Firmware · CVSS 6.5 · 2025-10-02 | 6.5 | 0.3% | 2025-10-02 |
| CVE-2025-36104IBM Storage Scale information disclosureIBM · Storage Scale · CVSS 6.5 · 2025-07-12 | 6.5 | 0.3% | 2025-07-12 |
| CVE-2025-64185Open OnDemand RPM packages create world writable locationsOSC · ondemand · CVSS 6.9 · 2025-11-20 | 6.9 | 0.3% | 2025-11-20 |
| CVE-2025-9039Information Disclosure in Amazon ECS Container AgentAmazon · ECS · CVSS 4.3 · 2025-08-14 | 4.3 | 0.3% | 2025-08-14 |
| CVE-2025-22448Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user to potentially enable denial of service v…Intel(R) Simics(R) Package Manager software · CVSS 6.1 · 2025-05-13 | 6.1 | 0.3% | 2025-05-13 |
| CVE-2023-29065Overly Permissive Access PolicyBecton, Dickinson and Company (BD) · FACSChorus · CVSS 4.1 · 2023-11-28 | 4.1 | 0.3% | 2023-11-28 |
| CVE-2020-5343Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability. A local authenticat…Dell · CPG SW · CVSS 7.3 · 2020-05-04 | 7.3 | 0.3% | 2020-05-04 |
| CVE-2024-36691Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information.No vendor recorded · CVSS 6.3 · 2024-06-12 | 6.3 | 0.3% | 2024-06-12 |
| CVE-2025-65111SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Resultsauthzed · spicedb · CVSS 2.9 · 2025-11-21 | 2.9 | 0.2% | 2025-11-21 |
| CVE-2024-27847This issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventu…Apple · iOS and iPadOS · CVSS 7.4 · 2024-05-13 | 7.4 | 0.2% | 2024-05-13 |
| CVE-2024-23233This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used by a malicious app.Apple · macOS · CVSS 7.8 · 2024-03-08 | 7.8 | 0.2% | 2024-03-08 |
| CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.django-helpdesk Project · django-helpdesk · CVSS 5.1 · 2025-05-31 | 5.1 | 0.2% | 2025-05-31 |
| CVE-2024-27848This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to gain root privilege…Apple · iOS and iPadOS · CVSS 7.4 · 2024-06-10 | 7.4 | 0.2% | 2024-06-10 |
| CVE-2024-29417Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.No vendor recorded · CVSS 8.4 · 2024-05-03 | 8.4 | 0.2% | 2024-05-03 |
| CVE-2024-27825A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to bypa…Apple · macOS · CVSS 7.8 · 2024-05-13 | 7.8 | 0.2% | 2024-05-13 |
| CVE-2025-32797Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Executionconda · conda-build · CVSS 6 · 2025-06-16 | 6.0 | 0.2% | 2025-06-16 |
| CVE-2025-20008Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to potentially enable escalation of privilege…Intel(R) Simics(R) Package Manager software · CVSS 7.7 · 2025-05-13 | 7.7 | 0.2% | 2025-05-13 |
| CVE-2024-45599TCC Bypass in Cursor's macOS Applicationgetcursor · cursor · CVSS 3.8 · 2024-09-24 | 3.8 | 0.2% | 2024-09-24 |
| CVE-2023-45736Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local a…Intel · Intel(R) Power Gadget software for Windows · CVSS 6.7 · 2024-05-16 | 6.7 | 0.2% | 2024-05-16 |
| CVE-2023-39230Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of pri…Intel · Intel Rapid Storage Technology software · CVSS 6.7 · 2023-11-14 | 6.7 | 0.2% | 2023-11-14 |
| CVE-2023-34997Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable es…Intel · Intel Server Configuration Utility software · CVSS 6.7 · 2023-11-14 | 6.7 | 0.2% | 2023-11-14 |
| CVE-2023-34314Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation of privilege via lo…Intel · Intel(R) Simics Simulator software · CVSS 6.7 · 2023-11-14 | 6.7 | 0.2% | 2023-11-14 |
| CVE-2023-33870Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of privilege via local…Intel · Intel(R) Ethernet tools and driver install software · CVSS 6.7 · 2024-02-14 | 6.7 | 0.2% | 2024-02-14 |
| CVE-2023-28207The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissi…Apple · macOS · CVSS 5.5 · 2025-03-21 | 5.5 | 0.2% | 2025-03-21 |
| CVE-2022-41700Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentially enable escalatio…Intel · Intel(R) NUC Pro Software Suite installation software · CVSS 6.7 · 2023-11-14 | 6.7 | 0.2% | 2023-11-14 |
| CVE-2022-33898Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially enable escalation o…Intel · Intel(R) NUC Watchdog Timer installation software · CVSS 6.7 · 2023-11-14 | 6.7 | 0.2% | 2023-11-14 |
| CVE-2023-33990Denial of Service (DoS) vulnerability in SAP SQL AnywhereSAP_SE · SAP SQL Anywhere · CVSS 7.8 · 2023-07-11 | 7.8 | 0.2% | 2023-07-11 |
| CVE-2026-20630A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access pr…Apple · macOS · CVSS 5.5 · 2026-02-11 | 5.5 | 0.2% | 2026-02-11 |
| CVE-2024-21835Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privilege via local acces…Intel · Intel(R) XTU software · CVSS 6.7 · 2024-05-16 | 6.7 | 0.2% | 2024-05-16 |
| CVE-2025-31332Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE · SAP BusinessObjects Business Intelligence Platform · CVSS 6.6 · 2025-04-08 | 6.6 | 0.2% | 2025-04-08 |
| CVE-2022-36377Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Windows may allow an a…Intel · Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits &… · CVSS 6.7 · 2022-11-11 | 6.7 | 0.2% | 2022-11-11 |
| CVE-2024-51448IBM Robotic Process Automation privilege escalationIBM · Robotic Process Automation · CVSS 6.7 · 2025-01-18 | 6.7 | 0.1% | 2025-01-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.