Rocky Linux 8 : container-tools:2.0 (RLSA-2021:0706)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:0706 advisory. - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abus...

Code injection

The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Package.Availability.exe is susceptible t...

The vulnerability in the corporate version of the GitHub Enterprise Server, related to the improper assignment of permissions for files, allows a violator to obtain the MySQL password.

The vulnerability in the corporate version of the GitHub Enterprise Server is related to the improper assignment of permissions for files. Exploiting this vulnerability could allow a hacker to obtain the MySQL password...

CVE-2023-45690

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690

CVE-2023-45690 is part of a set of post-authentication issues in South River Technologies’ Titan MFT/SFTP servers (Linux) that were disclosed by multiple sources. Connected documents show concrete details: (1) 45690 describes an information leak via a world-readable database and logs, enabling an...

CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

SUSE-SU-2023:4059-1 Security update for samba

This update for samba fixes the following issues: - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. bsc1215904 - CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep call on AD DC. bso1215905 - CVE-2023-4154:...

Juniper Networks Junos OS and Junos OS Evolved Security Vulnerabilities

Juniper Networks Junos OS and Juniper Networks Junos OS Evolved are both products of Juniper Networks, Inc.Juniper Networks Junos OS is a network operating system designed for use with the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK...

UBUNTU-CVE-2023-44387

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to...

File and Directory Permissions Vulnerability in JP1/Performance Management

Overview A File and Directory Permissions Vulnerability CVE-2023-3440 exists in JP1/Performance Management. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take...

PT-2023-5390 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.423 and earlier, LTS versions 2.414.1 and earlier Description: The issue is related to the creation of a temporary file in the system temporary directory with default permissions when installing a plugin from a URL. This...

Docker Desktop < 4.5.0 Incorrect File Permissions

The version of Docker Desktop for Windows is prior to 4.5.0. It is therefore affected by a vulnerability that allows attackers to move arbitrary files. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

The vulnerability of the Apache Hadoop distributed development and execution platform, related to the improper assignment of permissions for files, allows a hacker to circumvent access restrictions on files.

The vulnerability of the Apache Hadoop distributed development and execution platform is related to the improper assignment of permissions for files. Exploiting this vulnerability allows a malicious actor to circumvent restrictions on file access remotely...

Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Information Exposure

Overview railties is an application bootup, plugins, generators, and rake tasks. Affected versions of this package are vulnerable to Information Exposure. The ImpactActiveSupport::EncryptedFile method writes contents that will be encrypted to a temporary file. The temporary file’s permissions are...

PT-2023-26260

Name of the Vulnerable Software and Affected Versions Active Support versions 5.2.0 through 7.0.7.0 Active Support versions 6.1.7.4 and earlier Description The issue arises from ActiveSupport::EncryptedFile writing contents to a temporary file with permissions defaulted to the user's current umas...

Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions

Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.2.14 Tested on: Windows CVE : CVE-2023-31067 TSplus Remote Access v...