CWE-281 vulnerabilities

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.

CVE-2025-32696 is an Improper Preservation of Permissions vulnerability in Wikimedia Foundation's MediaWiki software. It affects specific program files related to revert actions and API file revert functionality. The issue impacts MediaWiki versions before 1.39.12, 1.42.6, and 1.43.1. The vulnerability was published on April 10, 2025. No public exploits or active exploitation are known at this time.

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.

Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation

CVE-2024-22114 is a vulnerability in Zabbix where users without permissions to any hosts can still view host counts and other statistics via the System Information Widget on the Global View Dashboard. This improper preservation of permissions allows unauthorized information disclosure but does not affect integrity or availability.

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.