PSF-2024-1

An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged...

Python Security Vulnerabilities

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and earlier versions, which...

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

GHSA-X2H8-QMJ4-G62F ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions (CVE-2013-6685)

The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gain privileges by mounting a device with a setuid file in its filesystem, aka Bug ID CSCui04382. This plugin only works with Tenable.ot. Please visit...

CVE-2024-28862

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

CVE-2024-28862

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

CVE-2024-28862 ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

The Ruby One Time Password library ROTP is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation...

Insecure File Permissions

rack-cors is vulnerable to Insecure File Permissions. The vulnerability is due to the distribution of files with world-writable permissions. This can potentially lead to unauthorized disclosure or modification...

Rack CORS Middleware has Insecure File Permissions

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

GHSA-785G-282Q-PWVX Rack CORS Middleware has Insecure File Permissions

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

CVE-2024-27456

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

CVE-2024-27456

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

CVE-2024-27456

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

Rack CORS Middleware has Insecure File Permissions

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

Rack Security Vulnerabilities

Rack is a modular Ruby web server interface. A security vulnerability exists in rack-cors version 2.0.1 that stems from the presence of insecure file permissions...

CVE-2023-50236

A vulnerability has been identified in Polarion ALM All versions V2404.0. The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privileges to NT AUTHORITY\SYSTEM...

CVE-2024-23447

The CVE-2024-23447 entry relates to Elastic Network Drive Connector and the Windows Network Drive Connector, where a misconfiguration of Document Level Security (explicit allow write and deny read) allows a user to see a document in search results even though it is not accessible in the network d...

CVE-2024-23447 Elastic Network Drive Connector Improper Access Control

An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user...

CVE-2023-34042

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical...