CVE-2025-38747

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2025-38747

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2025-38747

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2025-41658

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions...

CVE-2025-41658

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions...

CVE-2025-41658

The CVE-2025-41658 entry concerns CODESYS Runtime Toolkit-based products where default file permissions may allow local low-privileged OS users to access sensitive files. The publicly provided material confirms the affected component is the CODESYS Runtime Toolkit and cites potential exposure of ...

CODESYS Runtime Toolkit 安全漏洞

CODESYS Runtime Toolkit is a comprehensive software development kit for programmable controllers from CODESYS, Germany. It is used to transform embedded platforms or industrial PCs into controllers and supports secondary development. A security vulnerability exists in CODESYS Runtime Toolkit, whi...

GO-2025-3785 filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser

filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser...

Improper File Permissions

chainguard.dev/melange is vulnerable to improper file permissions. The vulnerability is due to SBOM files in APKs being generated with file system permissions mode 666, which allows an attacker to tamper with the SBOMs...

Improper File Permissions

apko is vulnerable to Improper File Permissions. The vulnerability is due to critical files being inadvertently set with world-writable permissions 0666, which allows an attacker to likely escalate privileges to root...

cloud-init security update

23.4-7.0.2.el810.10 - Fixes regression in cloud-init with module ccwritefilesdeferred Orabug: 37382965 - Update IPv6 IMDS endpoint to ULA and drop NIC identifier Orabug: 35965980 - Enable IPv6 Orabug: 36502414 - Added missing services in rhel/systemd/cloud-init.service Orabug: 32183938 - Increase...

GHSA-5662-CV6M-63WH melange's world-writable permissions expose SBOM files to potential image tampering

It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666: $ apkrane ls https://packages.wolfi.dev/os/x8664/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2/dev/null var/lib/db/sbom drwxr-xr-x root/root 0 2025-06-23 14:1...

melange's world-writable permissions expose SBOM files to potential image tampering

It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666: $ apkrane ls https://packages.wolfi.dev/os/x8664/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2/dev/null var/lib/db/sbom drwxr-xr-x root/root 0 2025-06-23 14:1...

CVE-2025-54059 melange creates SBOM files in APKs with world-writable permissions

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

PT-2025-30050 · Apko · Apko

Name of the Vulnerable Software and Affected Versions: apko versions 0.27.0 through 0.29.4 Description: apko is a tool that allows users to build and publish OCI container images built from apk packages. In versions prior to 0.29.5, critical files were inadvertently set to 0666, which could...

PT-2025-30051 · Melange · Melange

Name of the Vulnerable Software and Affected Versions: melange versions 0.23.0 through 0.29.4 Description: melange allows users to build apk packages using declarative pipelines. SBOM files generated by melange in apks had file system permissions mode 666, potentially allowing an unprivileged use...

apko 安全漏洞

apko is an apk-based OCI image builder from apko open source. A security vulnerability exists in versions prior to apko 0.27.0 through 0.29.5, which stems from improperly set file permissions and may result in elevated privileges...

CVE-2025-7699

The CVE-2025-7699 issue affects ADM’s EZ Sync Manager. A lack of authorization checks on the HTTP file parameter allows authenticated users to copy arbitrary server files into their EZSync folder, potentially exposing sensitive data. Affected: ADM 4.1.0–4.3.3.RH61 and ADM 5.0.0.RIN1 and earlier. ...

BIT-APISIX-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

CVE-2025-27613 Gitk can create and truncate files in the user's home directory

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled...