Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

CVEs (350)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-50924 1Silabs 1Z Wave Software Development Kit Jun 17, 2026 Dec 10, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the c...Show more Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller.Show less
CVE-2024-50921 1Silabs 1Z Wave Software Development Kit Jun 17, 2026 Dec 10, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller.
CVE-2024-50920 1Silabs 1Z Wave Software Development Kit Jun 17, 2026 Dec 10, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.
CVE-2024-41650 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d.
CVE-2024-41649 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread_.
CVE-2024-41648 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.
CVE-2024-41646 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.
CVE-2024-41645 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.
CVE-2024-41644 1Openrobotics 1Robot Operating System Jun 17, 2026 Dec 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.
CVE-2024-37575 - - Jun 17, 2026 Dec 4, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.miste...Show more The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component.Show less
CVE-2024-43784 - - Jun 17, 2026 Nov 26, 2024 N/A· v4 5.7 MEDIUM· v3 N/A· v2 lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating...Show more lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames.Show less
CVE-2024-52522 - - Jun 17, 2026 Nov 15, 2024 5.4 MEDIUM· v4 N/A· v3 N/A· v2 Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivi...Show more Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.Show less
CVE-2024-36062 - - Jun 17, 2026 Nov 7, 2024 N/A· v4 4.0 MEDIUM· v3 N/A· v2 The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted in...Show more The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.callassistant.android.ui.call.incall.InCallActivity component.Show less
CVE-2024-10458 1Mozilla 2Firefox Thunderbird Jun 17, 2026 Oct 29, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, a...Show more A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.Show less
CVE-2024-44193 1Apple 1Itunes Jun 17, 2026 Oct 2, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.
CVE-2024-9333 - - Jun 17, 2026 Oct 2, 2024 5.3 MEDIUM· v4 N/A· v3 N/A· v2 Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation
CVE-2024-44188 1Apple 1Macos Jun 17, 2026 Sep 17, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVE-2024-44149 1Apple 1Macos Jun 17, 2026 Sep 17, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVE-2024-40859 1Apple 1Macos Jun 17, 2026 Sep 17, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
CVE-2024-40831 1Apple 1Macos Jun 17, 2026 Sep 17, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library.

Previous 1...567...18 Next