Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
439 vulnerabilities reference this CWE, most recent first.
GHSA-66VW-V2X9-HW75
Vulnerability from github – Published: 2022-04-30 00:00 – Updated: 2024-09-16 17:22
VLAI
Summary
Podman publishes a malicious image to public registries
Details
Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/psgo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1227"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-03T06:15:16Z",
"nvd_published_at": "2022-04-29T16:15:00Z",
"severity": "HIGH"
},
"details": "Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the \u0027podman top\u0027 command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.",
"id": "GHSA-66vw-v2x9-hw75",
"modified": "2024-09-16T17:22:51Z",
"published": "2022-04-30T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1227"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/issues/10941"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/13862"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/13862/commits/79a3e149c10f74db4cebff624287385c90179d09"
},
{
"type": "WEB",
"url": "https://github.com/containers/psgo/pull/92"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070368"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/podman"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0558"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240628-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Podman publishes a malicious image to public registries"
}
GHSA-67CG-J2QQ-7WV4
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30
VLAI
Details
Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-40767"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:16:49Z",
"severity": "HIGH"
},
"details": "Unauthenticated Broken Access Control in wpForo Forum \u003c 3.0.2 versions.",
"id": "GHSA-67cg-j2qq-7wv4",
"modified": "2026-06-15T21:30:46Z",
"published": "2026-06-15T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40767"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6879-GF6Q-3QMJ
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31
VLAI
Details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-40770"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:48Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.",
"id": "GHSA-6879-gf6q-3qmj",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40770"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6FQ2-7QRW-4C53
Vulnerability from github – Published: 2023-06-26 21:30 – Updated: 2024-04-04 05:10
VLAI
Details
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2993"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T20:15:10Z",
"severity": "MODERATE"
},
"details": "A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.",
"id": "GHSA-6fq2-7qrw-4c53",
"modified": "2024-04-04T05:10:47Z",
"published": "2023-06-26T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2993"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-127357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6JRG-WP8H-9245
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:24
VLAI
Details
OX App Suite through 7.10.2 has Insecure Permissions.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2019-14226"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-14T17:15:00Z",
"severity": "HIGH"
},
"details": "OX App Suite through 7.10.2 has Insecure Permissions.",
"id": "GHSA-6jrg-wp8h-9245",
"modified": "2024-04-04T02:24:25Z",
"published": "2022-05-24T16:58:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14226"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2019/Oct/25"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6M9F-8VWQ-97PM
Vulnerability from github – Published: 2022-05-02 04:00 – Updated: 2024-02-08 22:08
VLAI
Summary
Smarty Does Not Consider Umask Values When Setting Permissions
Details
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "smarty/smarty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-beta4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-5054"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-08T22:08:36Z",
"nvd_published_at": "2011-02-03T17:00:00Z",
"severity": "MODERATE"
},
"details": "Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.",
"id": "GHSA-6m9f-8vwq-97pm",
"modified": "2024-02-08T22:08:36Z",
"published": "2022-05-02T04:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-5054"
},
{
"type": "PACKAGE",
"url": "https://github.com/smarty-php/smarty"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20101116174040/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Smarty Does Not Consider Umask Values When Setting Permissions"
}
GHSA-6P7M-F494-CJVP
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32
VLAI
Details
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-3762"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T16:29:00Z",
"severity": "MODERATE"
},
"details": "Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.",
"id": "GHSA-6p7m-f494-cjvp",
"modified": "2022-05-13T01:32:20Z",
"published": "2022-05-13T01:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3762"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/358339"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=nc-sa-2018-002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6R8G-4HXG-92RF
Vulnerability from github – Published: 2024-04-08 09:31 – Updated: 2024-10-31 21:31
VLAI
Details
Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-52542"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T09:15:08Z",
"severity": "MODERATE"
},
"details": "Permission verification vulnerability in the system module.\nImpact: Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-6r8g-4hxg-92rf",
"modified": "2024-10-31T21:31:44Z",
"published": "2024-04-08T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52542"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/3"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6V2P-8Q89-F8P6
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28
VLAI
Details
In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407
{
"affected": [],
"aliases": [
"CVE-2020-0327"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-18T16:15:00Z",
"severity": "MODERATE"
},
"details": "In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407",
"id": "GHSA-6v2p-8q89-f8p6",
"modified": "2022-05-24T17:28:39Z",
"published": "2022-05-24T17:28:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0327"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6WVR-WRJW-5G3C
Vulnerability from github – Published: 2025-06-10 12:30 – Updated: 2025-06-10 18:32
VLAI
Details
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.
This impacts OmniStudio: before Spring 2025.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-43700"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T12:15:24Z",
"severity": "HIGH"
},
"details": "Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.\u00a0\n\nThis impacts OmniStudio: before Spring 2025.",
"id": "GHSA-6wvr-wrjw-5g3c",
"modified": "2025-06-10T18:32:25Z",
"published": "2025-06-10T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43700"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/s/articleView?id=004980323\u0026type=1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.