CWE-281 · Access Control
Improper Preservation of Permissions
327CVEs
SortMost likely exploited
327 CVEs with CWE-281 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-8543In CISA KEVExploitedMicrosoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1,…Microsoft Corporation · Microsoft Windows · CVSS 9.8 · 2017-06-15 | 9.8 | 74% | 2017-06-15 |
| CVE-2024-46310CheckFXServer < v9601 - Information ExposureNo vendor recorded · CVSS 9.1 · 2025-01-13 | 9.1 | 2.6% | 2025-01-13 |
| CVE-2019-0233An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.Apache · Apache Struts · 2020-09-14 | – | 66% | 2020-09-14 |
| CVE-2017-8589Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016…Microsoft Corporation · Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Wi… · 2017-07-11 | – | 26% | 2017-07-11 |
| CVE-2017-8563Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016…Microsoft Corporation · Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Wi… · 2017-07-11 | – | 7.2% | 2017-07-11 |
| CVE-2017-8578Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Win…Microsoft Corporation · Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windo… · 2017-07-11 | – | 6.5% | 2017-07-11 |
| CVE-2021-32465An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an attack and bypass a…Trend Micro · Trend Micro Apex One · 2021-08-04 | – | 4.3% | 2021-08-04 |
| CVE-2022-1227A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victi…Podman Project · psgo · 2022-04-29 | – | 4.2% | 2022-04-29 |
| CVE-2023-34034Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a sec…Vmware · Spring Security · CVSS 9.1 · 2023-07-19 | 9.1 | 4.1% | 2023-07-19 |
| CVE-2001-1515Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which may cause the direct…Microsoft · Windows 2000 · 2005-07-14 | – | 4.0% | 2005-07-14 |
| CVE-2005-1920The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could a…Kde · Kde · 2005-07-26 | – | 3.7% | 2005-07-26 |
| CVE-2020-8913Local arbitrary code execution in splitinstall in Android's Play CoreGoogle LLC · Android Play Core · CVSS 8.8 · 2020-08-12 | 8.8 | 2.9% | 2020-08-12 |
| CVE-2021-41091Insufficiently restricted permissions on data directory in Docker Enginemoby · moby · CVSS 6.3 · 2021-10-04 | 6.3 | 2.8% | 2021-10-04 |
| CVE-2020-16910Windows Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1803 · CVSS 6.2 · 2020-10-16 | 6.2 | 2.8% | 2020-10-16 |
| CVE-2017-8465Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run processes in an elevated…Microsoft Corporation · Microsoft Windows · 2017-06-15 | – | 2.3% | 2017-06-15 |
| CVE-2022-38577ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.Processmaker · Processmaker · CVSS 8.8 · 2022-09-19 | 8.8 | 2.3% | 2022-09-19 |
| CVE-2018-4115An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The…Apple · Tvos · 2018-04-03 | – | 2.2% | 2018-04-03 |
| CVE-2018-5163If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScri…Mozilla · Firefox · 2018-06-11 | – | 2.0% | 2018-06-11 |
| CVE-2021-45008Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-…Plesk · Plesk · CVSS 8.8 · 2022-02-21 | 8.8 | 2.0% | 2022-02-21 |
| CVE-2020-5796Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users be…Nagios · Nagios XI · 2020-11-13 | – | 2.0% | 2020-11-13 |
| CVE-2017-8494Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a locally-authenticated attacker to run a specially crafted application on a targeted system when Wi…Microsoft Corporation · Microsoft Windows · 2017-06-15 | – | 1.9% | 2017-06-15 |
| CVE-2022-32969MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such f…Metamask · Metamask · 2022-06-29 | – | 1.8% | 2022-06-29 |
| CVE-2021-43816Improper Preservation of Permissions in containerdcontainerd · containerd · CVSS 8 · 2022-01-05 | 8.0 | 1.8% | 2022-01-05 |
| CVE-2017-5033Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which…Google · Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.1… · 2017-04-24 | – | 1.7% | 2017-04-24 |
| CVE-2020-13308A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by be…GitLab · GitLab · CVSS 2.7 · 2020-09-15 | 2.7 | 1.6% | 2020-09-15 |
| CVE-2020-7063Files added to tar with Phar::buildFromIterator have all-access permissionsPHP Group · PHP · CVSS 5.5 · 2020-02-27 | 5.5 | 1.6% | 2020-02-27 |
| CVE-2021-30912The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious applica…Apple · macOS · 2021-08-24 | – | 1.6% | 2021-08-24 |
| CVE-2020-6564Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.Google · Chrome · 2020-09-21 | – | 1.5% | 2020-09-21 |
| CVE-2020-18890Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php.Puppycms · Puppycms · 2021-05-06 | – | 1.5% | 2021-05-06 |
| CVE-2024-29735Apache Airflow: Potentially harmful permission changing by log task handlerApache Software Foundation · Apache Airflow · CVSS 5.3 · 2024-03-26 | 5.3 | 1.5% | 2024-03-26 |
| CVE-2019-13727Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.Google · Chrome · 2019-12-10 | – | 1.4% | 2019-12-10 |
| CVE-2020-13763In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.Joomla · Joomla! · 2020-06-02 | – | 1.4% | 2020-06-02 |
| CVE-2024-28746Apache Airflow: Ignored Airflow PermissionsApache Software Foundation · Apache Airflow · CVSS 8.1 · 2024-03-14 | 8.1 | 1.3% | 2024-03-14 |
| CVE-2023-47463Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentic…Gl-Inet · Gl-Ax1800 Firmware · CVSS 9.8 · 2023-11-30 | 9.8 | 1.3% | 2023-11-30 |
| CVE-2017-8468Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run processes in an elevated…Microsoft Corporation · Microsoft Windows · 2017-06-15 | – | 1.3% | 2017-06-15 |
| CVE-2020-8190Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.Citrix · Citrix ADC, Citrix Gateway · 2020-07-10 | – | 1.2% | 2020-07-10 |
| CVE-2021-39897Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the…GitLab · GitLab · CVSS 2.6 · 2021-11-04 | 2.6 | 1.2% | 2021-11-04 |
| CVE-2019-14226OX App Suite through 7.10.2 has Insecure Permissions.Open-Xchange · Open-Xchange Appsuite · 2019-10-14 | – | 1.2% | 2019-10-14 |
| CVE-2017-8579The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially…Microsoft Corporation · Microsoft Windows · 2017-06-29 | – | 1.2% | 2017-06-29 |
| CVE-2019-20846An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.Mattermost · Mattermost Server · 2020-06-19 | – | 1.1% | 2020-06-19 |
| CVE-2019-20843An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.Mattermost · Mattermost Server · 2020-06-19 | – | 1.1% | 2020-06-19 |
| CVE-2017-8466Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation of privilege, aka "W…Microsoft Corporation · Windows Cursor · 2017-06-15 | – | 1.1% | 2017-06-15 |
| CVE-2020-36070Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component.Thecontrolgroup · Voyager · CVSS 9.8 · 2023-04-26 | 9.8 | 1.1% | 2023-04-26 |
| CVE-2020-10083GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.Gitlab · Gitlab · 2020-03-13 | – | 1.1% | 2020-03-13 |
| CVE-2022-2787stricter rules on chroot namesDebian · schroot · 2022-08-27 | – | 1.1% | 2022-08-27 |
| CVE-2020-8633An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.Synacor · Zimbra Collaboration Suite · 2020-02-18 | – | 1.1% | 2020-02-18 |
| CVE-2019-15621Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as…Nextcloud · Nextcloud Server · 2020-02-04 | – | 1.1% | 2020-02-04 |
| CVE-2019-11748WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile…Mozilla · Firefox · 2019-09-27 | – | 1.0% | 2019-09-27 |
| CVE-2017-8593Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Win…Microsoft Corporation · Windows Kernel-Mode Drivers · 2017-08-08 | – | 1.0% | 2017-08-08 |
| CVE-2021-29971If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission. *Th…Mozilla · Firefox · 2021-08-05 | – | 1.0% | 2021-08-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.