CVE-2022-29594

eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM...

CVE-2022-29594

eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM...

CVE-2022-29594

eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM...

CVE-2022-29594

eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM...

CVE-2022-29594

The CVE affects eG Agent prior to version 7.2, where weak file permissions can allow local privilege escalation to SYSTEM. The root cause is permission misconfiguration on sensitive files used by the agent. In affected environments, exploitation would grant full host privileges; no exploit detail...

SaltStack Salt Allows creating certificates with weak file permissions

The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions...

WordPress Change Uploaded File Permissions plugin <= 4.0.0 - File Permission Update via Cross-Site Request Forgery (CSRF) vulnerability

File Permission Update via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress Change Uploaded File Permissions plugin versions = 4.0.0. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This...

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the plugin is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this. document.getElementById"test".submit;...

The vulnerability of the FANUC ROBOGUIDE simulation software for robotics, related to errors in assigning permissions to files, allows a hacker to increase their privileges.

The vulnerability of the FANUC ROBOGUIDE software for robotization-related modeling tasks is related to errors in assigning permissions to files. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2022-0997

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...

CVE-2022-0486

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is...

Input validation

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...

Input validation

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is...

CVE-2022-0486 Privileged Command Injection Vulnerability in Fidelis Network and Deception

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is...

CVE-2022-0486

CVE-2022-0486 affects Fidelis Network and Deception components (CommandPost, Collector, Sensor, Sandbox) where improper file permissions allow a locally privileged attacker to modify affected files and escalate to root. Affected versions are Fidelis Network and Deception prior to 9.4.5; patches/u...

CVE-2022-0997 Local Privilege Escalation Vulnerability in Fidelis Network and Deception

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...

CVE-2022-0997

CVE-2022-0997 affects Fidelis Network and Deception components (CommandPost, Collector, Sensor). The issue is improper file permissions that allow a locally authenticated, admin user to modify affected script files, enabling arbitrary commands to execute as root upon a root user’s subsequent logi...

curl: CVE-2022-32207: Unpreserved file permissions

Summary: Curl fails to preserve file permissions when writing: - CURLOPTCOOKIEJAR database - CURLOPTALTSVC database - CURLOPTHSTS database Instead the permissions is always reset to 0666 & umask if the file is updated. As a result a file that was before protected against read access by other user...

ceph-deploy uses world-readable permissions on client.admin key

The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

GHSA-9W4F-3V37-6F75 ceph-deploy allows local users to obtain sensitive information by reading the file

ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...