CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

ALSA-2025:9178 Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

PT-2025-25763 · Unknown · Conda-Smithy

Name of the Vulnerable Software and Affected Versions: conda-smithy versions prior to 3.47.1 Description: The issue concerns a tool that combines a conda recipe with configurations for building using freely hosted CI services. Prior to version 3.47.1, a function in the repository creates files wi...

CVE-2025-32797

The Conda-build contains commands and tools to build Conda packages. Prior to version 25.3.1, The writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. This flaw allows attacker...

CVE-2025-32797

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

CVE-2025-32797 Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

GHSA-G8QW-MGJX-RWJR New authd users logging in via SSH are members of the root group

Impact When an authd user logs in via SSH for the first time meaning they do not yet exist in the authd user database and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user t...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

Sensitive Data Exposure

django-helpdesk is vulnerable to Sensitive Data Exposure. The vulnerability is due to insecure file permission settings due to os.umask0 in models.py, allows an attacker to access sensitive files or data that should be protected...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

CVE-2025-48959

CVE-2025-48959 affects Acronis Cyber Protect Cloud Agent (Windows) before build 40077. Local privilege escalation due to insecure file permissions is the root cause, with a local attack vector and low privileges required (user interaction required). The CVSSv3.0 base metrics indicate High impact ...

Acronis Cyber Protect Cloud Agent 安全漏洞

Acronis Cyber Protect Cloud Agent is a cloud agent from Acronis Switzerland. A security vulnerability exists in versions prior to Acronis Cyber Protect Cloud Agent 40077, which stems from insecure file permissions that could lead to local elevation of privilege...

PSF-2025-5

Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CVE-2024-12718 Bypass extraction filter to modify file metadata outside extraction directory

Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

Python 安全漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python 3.12 and later, which stems from the tarfile module extraction filter...

PT-2025-23800 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions before build 40077 Description: The issue is related to local privilege escalation due to insecure file permissions. Recommendations: For versions before build 40077, update to build 40077 or...

CVE-2025-32803 Insecure file permissions can result in confidential information leakage

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8...