Filtered by CWE-281
Filtered by vendor Subscriptions
Total 279 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-30827 1 Apple 2 Mac Os X, Macos 2024-11-21 7.8 High
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local attacker may be able to elevate their privileges.
CVE-2021-30482 1 Jetbrains 1 Upsource 2024-11-21 7.5 High
In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
CVE-2021-30279 1 Qualcomm 124 Ar8035, Ar8035 Firmware, Qca6390 and 121 more 2024-11-21 7.8 High
Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVE-2021-30152 3 Debian, Fedoraproject, Mediawiki 3 Debian Linux, Fedora, Mediawiki 2024-11-21 4.3 Medium
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
CVE-2021-29971 1 Mozilla 1 Firefox 2024-11-21 9.8 Critical
If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
CVE-2021-24032 2 Facebook, Redhat 2 Zstandard, Amq Streams 2024-11-21 4.7 Medium
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
CVE-2021-24031 1 Facebook 1 Zstandard 2024-11-21 5.5 Medium
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
CVE-2021-23999 2 Mozilla, Redhat 5 Firefox, Firefox Esr, Thunderbird and 2 more 2024-11-21 8.8 High
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVE-2021-23998 2 Mozilla, Redhat 5 Firefox, Firefox Esr, Thunderbird and 2 more 2024-11-21 6.5 Medium
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVE-2021-23963 1 Mozilla 1 Firefox 2024-11-21 4.3 Medium
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.
CVE-2021-22382 1 Huawei 4 E3372, E3372 Firmware, E8372 and 1 more 2024-11-21 6.5 Medium
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. Affected product versions include:E3372 E3372h-153TCPU-V200R002B333D01SP00C00.
CVE-2021-22137 2 Elastic, Redhat 3 Elasticsearch, Camel Quarkus, Integration 2024-11-21 5.3 Medium
In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
CVE-2021-22118 4 Netapp, Oracle, Redhat and 1 more 34 Hci, Management Services For Element Software, Commerce Guided Search and 31 more 2024-11-21 7.8 High
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
CVE-2021-22112 3 Oracle, Pivotal Software, Vmware 8 Communications Element Manager, Communications Interactive Session Recorder, Communications Unified Inventory Management and 5 more 2024-11-21 8.8 High
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
CVE-2021-21735 1 Zte 2 Zxhn H168n, Zxhn H168n Firmware 2024-11-21 6.5 Medium
A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
CVE-2021-21685 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 9.1 Critical
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
CVE-2021-21645 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 4.3 Medium
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
CVE-2021-21643 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 6.5 Medium
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.
CVE-2021-21379 1 Xwiki 1 Xwiki 2024-11-21 7.7 High
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.
CVE-2021-20263 1 Qemu 1 Qemu 2024-11-21 3.3 Low
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.