51 matches found
CVE-2024-8533
A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions allowing users to exfiltrate credentials and escalate privileges...
CVE-2024-8533
A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions allowing users to exfiltrate credentials and escalate privileges...
CVE-2024-8533
The CVE-2024-8533 issue affects Rockwell Automation OptixPanel products (e.g., 2800C OptixPanel Compact, 2800S OptixPanel Standard, Embedded Edge Compute Module). The vulnerability stems from improper default file permissions in the affected software, enabling credential exfiltration and privileg...
PT-2024-28855 · No Ip · No-Ip Dynamic Update Client
Name of the Vulnerable Software and Affected Versions: No-IP Dynamic Update Client DUC versions 3.x Description: The No-IP Dynamic Update Client DUC v3.x uses cleartext credentials that may occur on a command line or in a file. The vendor's position is that cleartext in /etc/default/noip-duc is...
Rockwell Automation多款产品 安全漏洞
Rockwell Automation 2800C OptixPanel Compact and others are products of Rockwell Automation, Inc.Rockwell Automation 2800C OptixPanel Compact is a compact operator panel. Rockwell Automation 2800S OptixPanel Standard is a standard operator panel.Rockwell Automation Embedded Edge Compute Module is...
CVE-2024-7513
CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions...
PT-2024-37727 · WordPress · Optimize Images Alt Text (Alt Tag) & Names For Seo Using Ai
Name of the Vulnerable Software and Affected Versions: Optimize Images ALT Text alt tag & names for SEO using AI plugin for WordPress versions up to, and including, 3.1.1 Description: The plugin is vulnerable to Full Path Disclosure due to its utilization of cocur and failure to prevent direct...
VulnCheck KEV: CVE-2022-22948
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information...
CVE-2024-1200
A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and...
CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers
Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...
CVE-2023-28724
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
Ego Studio SuperClean 资源管理错误漏洞
Ego Studio SuperClean is a versatile and powerful phone cleaner, reliable optimizer for Android from Ego Studio. A security vulnerability exists in Ego Studio SuperClean version v.1.1.9, v.1.1.5. An attacker exploited the vulnerability to gain privileges via the updateinfo field of the default.xm...
xsjczx Shaoxing Background Management System SQL注入漏洞
The xsjczx Shaoxing Background Management System is a background management system from the Chinese company xsjczx punctuation information technology. A SQL injection vulnerability exists in xsjczx Shaoxing Background Management System, which originates from unknown code in the file /Default/Bd,...
Jirafeau 跨站脚本漏洞
Jirafeau is an easy way to upload files by the individual developer Jérôme Jutteau. A security vulnerability exists in Jirafeau versions prior to 4.4.0, which stems from a file preview feature enabled by default that can be used for cross-site scripting. An attacker could use this vulnerability t...
PT-2022-1771 · Unknown · Log4Js-Node
Name of the Vulnerable Software and Affected Versions: log4js-node versions prior to 6.4.0 Description: The issue is related to the default file permissions for log files created by the file, fileSync, and dateFile appenders in log4js-node, which are world-readable in Unix. This could cause...
CVE-2021-20037
SonicWall Global VPN Client 4.10.5 installer (and earlier) contains an incorrect default file-permission issue that enables local privilege escalation and potentially command execution on the host. Root cause: improper permissions on installer components. Impact: local attacker could obtain eleva...
SonicWall Global VPN client 安全漏洞
Sonicwall SonicWall Global VPN client is a Vpn software from SonicWall USA that works with the SonicWALL firewall. The software enables remote employees and vendors to access the company's network. A security vulnerability exists in SonicWall Global VPN Client 4.10.5 that stems from incorrect...
ProxyLogon - PoC Exploit for Microsoft Exchange
PoC Exploit for Microsoft Exchange Launche Original PoC: https://github.com/testanull How to use: python proxylogon.py Example: python proxylogon.py primary [email protected] If successful you will be dropped into a webshell. exit or quit to escape from the webshell or ctrl+c By default, it...
ALPINE-CVE-2021-24032
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to...
CVE-2021-24031
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore be readable or writable to unintended parties...