3800 matches found
CVE-2024-27456
rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...
Rack CORS Middleware has Insecure File Permissions
rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...
CVE-2023-50236
A vulnerability has been identified in Polarion ALM All versions V2404.0. The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privileges to NT AUTHORITY\SYSTEM...
CVE-2024-23447 Elastic Network Drive Connector Improper Access Control
An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user...
CVE-2024-23447
The CVE-2024-23447 entry relates to Elastic Network Drive Connector and the Windows Network Drive Connector, where a misconfiguration of Document Level Security (explicit allow write and deny read) allows a user to see a document in search results even though it is not accessible in the network d...
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical...
File and Directory Permissions Vulnerability in Hitachi Tuning Manager
Overview A File and Directory Permissions Vulnerability CVE-2023-6457 exists in Hitachi Tuning Manager. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take...
rpm: races with chown/chmod/capabilities calls during installation
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system...
GLSA-202401-31 : containerd: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202401-31 containerd: Multiple Vulnerabilities - containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Uni...
CVE-2024-21840
CVE-2024-21840 concerns the Hitachi Storage Plug‑in for VMware vCenter. Affected versions are 04.0.0 through 04.9.2. The issue is an "Incorrect Default Permissions" vulnerability that enables local users to read and write specific files. The primary root cause is misconfigured default permissions...
The vulnerability of cloud software for creating and using Nextcloud Server’s data storage solution lies in the improper assignment of permissions to files, allowing a hacker to delete any files they desire.
The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the improper assignment of permissions for files. Exploiting this vulnerability could allow a malicious actor to delete any files they desire...
Siemens SCALANCE LPE9403 Improper Preservation of Permissions (CVE-2021-41089)
A vulnerability was found in Moby Docker Engine where attempting to copy files using 'docker cp' into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, widening access to others. This bug does not directly allow files to be read,...
OESA-2024-1039 jersey security update
Jersey is the open source JAX-RS JSR 311 production quality Reference Implementation for building RESTful Web services. %if Security Fixes: Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the...
OESA-2024-1038 jersey security update
Jersey is the open source JAX-RS JSR 311 production quality Reference Implementation for building RESTful Web services. %if Security Fixes: Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the...
CVE-2022-45793 Executable files writable by low-privileged users in Omron Sysmac Studio
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user...
CVE-2023-50974
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...
PYSEC-2024-2
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...
PT-2024-14035 · Appwrite · Appwrite Cli
Name of the Vulnerable Software and Affected Versions: Appwrite CLI versions prior to 3.0.0 Description: The issue arises when using the login command in Appwrite CLI, where the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. This allows...