Insecure File Permissions

Mailman uses insecure file permissions. It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives...

Information Disclosure

jboss application server is vulnerable to information disclosure. The default configuration for the Command Line Interface created a history file .jboss-cli-history in the user's home directory with insecure file permissions. This allows a malicious local user to gain information otherwise not...

Insecure File Permissions

BusyBox uses insecure file permissions. The mdev utility creates certain directories within the /dev with world-writable permissions 0777, which would allow a local unprivileged user to perform read, write and execute actions within the /dev directory tree...

Fedora 28 : php-symfony (2018-9b54497b6e)

2.8.44 2018-08-01 - security cve-2018-14774 HttpKernel fix trusted headers management in HttpCache and InlineFragmentRenderer nicolas-grekas - security cve-2018-14773 HttpFoundation Remove support for legacy and risky HTTP headers nicolas-grekas - bug 28003 HttpKernel Fixes invalid REMOTEADDR in...

Design/Logic Flaw

A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations...

CVE-2018-18332

A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations...

Design/Logic Flaw

A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which could lead to other exploits on vulnerable installations...

CVE-2018-18331

A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which could lead to other exploits on vulnerable installations...

CVE-2018-18332

A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations...

CVE-2018-18331

CVE-2018-18331 affects Trend Micro OfficeScan XG. The vulnerability is described as weak file permissions on a particular folder for a specific group, allowing an attacker to alter files and potentially enable further exploits on vulnerable installations. The available connected documents reitera...

CVE-2018-18332

CVE-2018-18332 affects Trend Micro OfficeScan XG; weak file permissions could let an attacker manipulate key file permissions to modify other files and folders on vulnerable installations. CVSSv3 shows HIGH impact (7.5) with network access and no authentication; no remediation details are provide...

CVE-2018-18332

A Trend Micro OfficeScan XG weak file permissions vulnerability may allow an attacker to potentially manipulate permissions on some key files to modify other files and folders on vulnerable installations...

CVE-2018-18331

A Trend Micro OfficeScan XG weak file permissions vulnerability on a particular folder for a particular group may allow an attacker to alter the files, which could lead to other exploits on vulnerable installations...

CVE-2018-18093

Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access...

Input validation

Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access...

CVE-2018-18093

Intel VTune Amplifier 2018 for Windows (Update 3 and earlier) contains an elevation of privilege vulnerability due to improper installer file permissions, allowing a local unprivileged user to potentially gain privileged access. Intel’s advisory INTEL-SA-00194 confirms the issue and advises updat...

Linux - userfaultfd Bypasses tmpfs File Permissions Exploit

Using the userfaultfd API, it is possible to first register a userfaultfd region for any VMA that fulfills vmacanuserfault: It must be an anonymous VMA -vmops==NULL, a hugetlb VMA VMHUGETLB, or a shmem VMA -vmops==shmemvmops. This means that it is, for example, possible to register userfaulfd...

Linux - 'userfaultfd' Bypasses tmpfs File Permissions

Using the userfaultfd API, it is possible to first register a userfaultfd region for any VMA that fulfills vmacanuserfault: It must be an anonymous VMA -vmops==NULL, a hugetlb VMA VMHUGETLB, or a shmem VMA -vmops==shmemvmops. This means that it is, for example, possible to register userfaulfd...

Linux userfaultfd tmpfs File Permission Bypass

Linux: userfaultfd bypasses tmpfs file permissions CVE-2018-18397 Using the userfaultfd API, it is possible to first register a userfaultfd region for any VMA that fulfills vmacanuserfault: It must be an anonymous VMA -vmops==NULL, a hugetlb VMA VMHUGETLB, or a shmem VMA -vmops==shmemvmops. This...

Intel® Solid State Drive Toolbox File Permissions Advisory

Summary: A potential security vulnerability in Intel® Solid State Drive Toolbox may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-18097 Description: Improper directory permissions in IntelR Solid...