CVE-2025-11567: Incorrect Default Permissions

CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured...

PT-2025-46670

Name of the Vulnerable Software and Affected Versions FiberHome GPON ONU HG6145F1 RP4423 Description A flaw exists in FiberHome GPON ONU HG6145F1 RP4423 that allows prediction of the device’s factory default Wi-Fi password WPA/WPA2 pre-shared key from the SSID. The device uses a predictable...

PT-2025-46701

Name of the Vulnerable Software and Affected Versions Lenovo Dock Manager affected versions not specified Description An improper default permission issue exists in Lenovo Dock Manager. Under specific installation conditions, an authenticated local user may be able to redirect log files with...

FiberHome GPON ONU HG6145F1 security vulnerability

The FiberHome GPON ONU HG6145F1 is a router from FiberHome China. A security vulnerability exists in the FiberHome GPON ONU HG6145F1 RP4423, which stems from the device's use of a deterministic algorithm to generate a default WiFi password, which could lead an attacker to predict the password...

Schneider Electric PowerChute Serial Shutdown security vulnerability

Schneider Electric PowerChute Serial Shutdown is a UPS management, normal shutdown, and energy management software from Schneider Electric France. A security vulnerability exists in Schneider Electric PowerChute Serial Shutdown that stems from improperly set default permissions, which could resul...

Lenovo Dock Manager security vulnerability

Lenovo Dock Manager is a docking station firmware update software from Lenovo China. A security vulnerability exists in Lenovo Dock Manager that stems from improper default permissions that could result in log file redirection...

EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2025-2408)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this,cloud-init defau...

sudo-rs -- Authenticating user not recorded properly in timestamp

Trifecta Tech Foundation reports: With Defaults targetpw or Defaults rootpw enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as...

CVE-2025-63353

The FiberHome GPON ONU HG6145F1 (RP4423) is vulnerable to a critical flaw where the factory default WPA/WPA2 pre-shared key (PSK) can be predicted based on the broadcast SSID . The device employs a deterministic algorithm where the Wi-Fi password is derived from the SSID using the formula: HEX_A ...

CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha....

rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

An unsafe default behavior in Rack::QueryParser allows bypass of the paramslimit parameter count restriction when query string parameters are delimited by semicolons ; rather than ampersands &. The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, ...

EUVD-2025-93486

Incorrect default permissions for some IntelR Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of...

EUVD-2025-93501

Incorrect default permissions for some IntelR One Boot Flash Update IntelR OFU software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable...

EUVD-2025-93504

Incorrect default permissions for the IntelR Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable local code execution...

CVE-2025-31940

Incorrect default permissions for some IntelR Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of...

CVE-2025-27246

Incorrect default permissions for the IntelR Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable local code execution...

CVE-2025-27711

Incorrect default permissions for some IntelR One Boot Flash Update IntelR OFU software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable...

CVE-2025-32091

Incorrect default permissions in some firmware for the IntelR ArcTM B-series GPUs within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2025-31940

Intel Thread Director Visualizer software (pre-1.1.1) has incorrect default permissions in Ring 3 User Applications that may allow escalation of privilege. An unprivileged, authenticated user with high complexity conditions and local access, plus active user interaction, could impact confidential...

CVE-2025-31940

Incorrect default permissions for some IntelR Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of...