Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
441 vulnerabilities reference this CWE, most recent first.
GHSA-887Q-RM9X-7WG9
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2025-11-04 00:32
VLAI
Details
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-54465"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:15:29Z",
"severity": "CRITICAL"
},
"details": "A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.",
"id": "GHSA-887q-rm9x-7wg9",
"modified": "2025-11-04T00:32:11Z",
"published": "2024-12-12T03:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54465"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121839"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-89GV-GGJ8-GG3Q
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30
VLAI
Details
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-21541"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:20Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).",
"id": "GHSA-89gv-ggj8-gg3q",
"modified": "2025-01-21T21:30:56Z",
"published": "2025-01-21T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21541"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-89R5-96WF-852F
Vulnerability from github – Published: 2025-01-07 00:31 – Updated: 2025-01-08 18:30
VLAI
Details
The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.frovis.androidbase.call.DialerActivity component.
Severity
7.7 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53934"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T22:15:10Z",
"severity": "HIGH"
},
"details": "The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.frovis.androidbase.call.DialerActivity component.",
"id": "GHSA-89r5-96wf-852f",
"modified": "2025-01-08T18:30:48Z",
"published": "2025-01-07T00:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53934"
},
{
"type": "WEB",
"url": "https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone"
},
{
"type": "WEB",
"url": "https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone/blob/main/CVE-2024-53934"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8FJM-9J4R-Q49R
Vulnerability from github – Published: 2025-01-28 21:31 – Updated: 2025-01-28 21:31
VLAI
Details
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2024-40672"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T20:15:49Z",
"severity": "HIGH"
},
"details": "In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-8fjm-9j4r-q49r",
"modified": "2025-01-28T21:31:04Z",
"published": "2025-01-28T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40672"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-10-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8HH2-RXM8-7FJ8
Vulnerability from github – Published: 2022-03-30 00:00 – Updated: 2022-11-30 20:59
VLAI
Summary
Missing permission check in Jenkins Continuous Integration with Toad Edge Plugin
Details
A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:ci-with-toad-edge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-28147"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-30T20:59:30Z",
"nvd_published_at": "2022-03-29T13:15:00Z",
"severity": "MODERATE"
},
"details": "A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.",
"id": "GHSA-8hh2-rxm8-7fj8",
"modified": "2022-11-30T20:59:30Z",
"published": "2022-03-30T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28147"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/ci-with-toad-edge-plugin/commit/2b65d62ebb71ec727097aa409c623f9c7c3b2792"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/ci-with-toad-edge-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2635"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/03/29/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing permission check in Jenkins Continuous Integration with Toad Edge Plugin"
}
GHSA-8Q4V-39JW-37MV
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47
VLAI
Details
Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation of privilege, aka "Windows Cursor Elevation of Privilege Vulnerability".
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-8466"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-15T01:29:00Z",
"severity": "HIGH"
},
"details": "Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation of privilege, aka \"Windows Cursor Elevation of Privilege Vulnerability\".",
"id": "GHSA-8q4v-39jw-37mv",
"modified": "2022-05-13T01:47:33Z",
"published": "2022-05-13T01:47:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8466"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8466"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98844"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038671"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8R46-M6M6-R9PQ
Vulnerability from github – Published: 2023-04-16 06:30 – Updated: 2024-03-21 03:35
VLAI
Details
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-33990"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-16T04:15:00Z",
"severity": "CRITICAL"
},
"details": "Liferay Portal 6.2.5 allows Command=FileUpload\u0026Type=File\u0026CurrentFolder=/ requests when frmfolders.html exists.",
"id": "GHSA-8r46-m6m6-r9pq",
"modified": "2024-03-21T03:35:08Z",
"published": "2023-04-16T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33990"
},
{
"type": "WEB",
"url": "https://github.com/fu2x2000/Liferay_exploit_Poc"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W43-765R-W2W5
Vulnerability from github – Published: 2022-10-20 12:00 – Updated: 2022-10-21 19:01
VLAI
Details
The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-12744"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-20T11:15:00Z",
"severity": "HIGH"
},
"details": "The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.",
"id": "GHSA-8w43-765r-w2w5",
"modified": "2022-10-21T19:01:10Z",
"published": "2022-10-20T12:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12744"
},
{
"type": "WEB",
"url": "https://github.com/bwiltse/cve/blob/master/Verint/Verint-CVE-2020-12744.txt"
},
{
"type": "WEB",
"url": "https://github.com/bwiltse/verint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-92VM-P8P9-G4X5
Vulnerability from github – Published: 2024-05-17 18:30 – Updated: 2024-05-17 18:30
VLAI
Details
When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-3289"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T17:15:07Z",
"severity": "HIGH"
},
"details": "When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.",
"id": "GHSA-92vm-p8p9-g4x5",
"modified": "2024-05-17T18:30:43Z",
"published": "2024-05-17T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3289"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2024-08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9347-9W64-Q5WP
Vulnerability from github – Published: 2022-05-14 02:05 – Updated: 2023-08-17 22:33
VLAI
Summary
Jython Improper Access Restrictions vulnerability
Details
Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.python:jython-standalone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2b3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2027"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-17T22:33:35Z",
"nvd_published_at": "2015-02-13T15:59:00Z",
"severity": "MODERATE"
},
"details": "Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.",
"id": "GHSA-9347-9w64-q5wp",
"modified": "2023-08-17T22:33:35Z",
"published": "2022-05-14T02:05:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2027"
},
{
"type": "WEB",
"url": "https://github.com/jython/frozen-mirror/commit/053949e66d307168fd70b39725f4d3e6b642acc1"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=947949"
},
{
"type": "WEB",
"url": "https://github.com/jython/frozen-mirror/blob/b8d7aa4cee50c0c0fe2f4b235dd62922dd0f3f99/NEWS#L25C8-L25C15"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2015-0096.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00055.html"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:158"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"type": "PACKAGE",
"url": "jython/frozen-mirror"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Jython Improper Access Restrictions vulnerability"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.