CVE-2025-52900 File Browser has Insecure File Permissions

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the...

CVE-2025-49843

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

CVE-2025-49843

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

CVE-2025-49843

The CVE-2025-49843 issue affects conda-smithy prior to version 3.47.1, where the travis_headers function creates files with permissions exceeding 0o600, potentially allowing read/write access beyond the intended user. This weakens least-privilege protections and could let an attacker access confi...

CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

CVE-2025-49843 conda-smithy Has Incorrect Default File Permissions

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travisheaders function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write...

ALSA-2025:9178 Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

PT-2025-25763 · Unknown · Conda-Smithy

Name of the Vulnerable Software and Affected Versions: conda-smithy versions prior to 3.47.1 Description: The issue concerns a tool that combines a conda recipe with configurations for building using freely hosted CI services. Prior to version 3.47.1, a function in the repository creates files wi...

CVE-2025-32797

The Conda-build contains commands and tools to build Conda packages. Prior to version 25.3.1, The writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. This flaw allows attacker...

CVE-2025-32797

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

CVE-2025-32797 Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

GHSA-G8QW-MGJX-RWJR New authd users logging in via SSH are members of the root group

Impact When an authd user logs in via SSH for the first time meaning they do not yet exist in the authd user database and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user t...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

Sensitive Data Exposure

django-helpdesk is vulnerable to Sensitive Data Exposure. The vulnerability is due to insecure file permission settings due to os.umask0 in models.py, allows an attacker to access sensitive files or data that should be protected...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

CVE-2025-48959

CVE-2025-48959 affects Acronis Cyber Protect Cloud Agent (Windows) before build 40077. Local privilege escalation due to insecure file permissions is the root cause, with a local attack vector and low privileges required (user interaction required). The CVSSv3.0 base metrics indicate High impact ...

CVE-2025-48959

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40077...

Acronis Cyber Protect Cloud Agent 安全漏洞

Acronis Cyber Protect Cloud Agent is a cloud agent from Acronis Switzerland. A security vulnerability exists in versions prior to Acronis Cyber Protect Cloud Agent 40077, which stems from insecure file permissions that could lead to local elevation of privilege...