3873 matches found
ceph-deploy uses world-readable permissions on client.admin key
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
GHSA-9W4F-3V37-6F75 ceph-deploy allows local users to obtain sensitive information by reading the file
ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
GHSA-FCXW-HHXQ-48WX Insecure temporary file usage in Jenkins Git Client Plugin
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure...
CVE-2022-0997
Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...
Puppet allows local users to modify the permissions of arbitrary files
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...
Wondershare Dr.Fone 11.4.10 - Insecure File Permissions Vulnerability
Exploit Title: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://drfone.wondershare.com/ Software Link: https://download.wondershare.com/drfonefull3360.exe Version: 11.4.10 Tested on: Windows 10 64-bit Note:...
CVE-2021-44167
An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...
Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
Exploit Title: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions Date: 04/25/2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://drfone.wondershare.com/ Software Link: https://download.wondershare.com/drfonefull3360.exe Version: 11.4.10 Tested on: Window...
Wondershare Dr.Fone 11.4.10 Insecure Permissions
Exploit Title: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions Date: 04/25/2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://drfone.wondershare.com/ Software Link: https://download.wondershare.com/drfonefull3360.exe Version: 11.4.10 Tested on: Window...
NewStart CGSL MAIN 6.02 : glib2 Multiple Vulnerabilities (NS-SA-2022-0053)
The remote NewStart CGSL host, running version MAIN 6.02, has glib2 packages installed that are affected by multiple vulnerabilities: - The keyfile settings backend in GNOME GLib aka glib2.0 before 2.60.0 creates directories using gfilemakedirectorywithparents kfsb-dir, NULL, NULL and files using...
Arbitrary File Upload
WSO2 Carbon Services is vulnerable to arbitrary file upload. The vulnerability exists because the file upload permissions and validations are not properly handled which allows an attacker to upload arbitrary files...
NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2022-0058)
The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory...
CVE-2022-21230
This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to ...
CVE-2022-21230
CVE-2022-21230 affects all versions of the org.nanohttpd:nanohttpd package. During HTTP request body parsing, the body larger than 1024 bytes is written to a RandomAccessFile with insecure permissions, allowing other users on the host to view its contents (information disclosure). The issue is ro...
CVE-2022-21230
This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to ...
CVE-2021-21290
In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...
CVE-2022-20732
A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager VIM could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to improper access permissions for certain...
The vulnerability of the ICMPv4 protocol implementation in the Trace TCP/IP stack allows a attacker to compromise the integrity of the protected information.
The vulnerability in the implementation of the ICMPv4 protocol in the Trace TCP/IP stack is related to the improper assignment of permissions for files. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information...
BeyondTrust AppGuard Enterprise 安全漏洞
BeyondTrust AppGuard Enterprise is BeyondTrust's easy-to-use, industry-leading security and lower cost all-in-one remote access and remote support solution. A security vulnerability exists in BeyondTrust AppGuard Enterprise through 6.6.20.2, which originates when the affected product creates a...