GHSA-QV64-W99C-QCR9 Jenkins temporary uploaded file created with insecure permissions

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API MultipartFormDataParser create temporary files in the system temporary directory with the default permissions for newly created files. If these permissions are overly...

Jenkins temporary plugin file created with insecure permissions

Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...

CVE-2023-42322

Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information...

PT-2023-28315 · Icmsdev · Icms

Name of the Vulnerable Software and Affected Versions: icmsdev iCMS version 7.0.16 Description: The issue allows a remote attacker to obtain sensitive information due to an Insecure Permissions vulnerability. Recommendations: For version 7.0.16, update to a version that fixes the Insecure...

PT-2023-8994 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.423 and earlier, LTS versions 2.414.1 and earlier Description: The issue is related to the creation of temporary files with insecure permissions when processing file uploads using MultipartFormDataParser. This could...

CVE-2023-42322

The CVE-2023-42322 entry concerns an Insecure Permissions vulnerability in icmsdev iCMS v7.0.16 that enables a remote attacker to obtain sensitive information. The root cause is insecure permissions governing access to data, leading to information disclosure with high impact (Confidentiality/Inte...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description Medium SECURITY-3261 / CVE-2023-43494 Builds can be filtered by values of sensitive build variables High SECURITY-3245 / CVE-2023-43495 Stored XSS vulnerability High SECURITY-3072 / CVE-2023-43496 Temporary plugin file created with insecure permissions Low...

CVE-2023-41010

CVE-2023-41010 describes an Insecure Permissions vulnerability in the Sichuan Tianyi Kanghe / China Telecom Tianyi Home Gateway v.TEWA-700G. The issue allows a local attacker to obtain sensitive information via the device’s default password parameter . Affected product/version: v.TEWA-700G . Root...

PT-2023-27742 · Sichuan Tianyi Kanghe Communication Co. · Tianyi Home Gateway

Name of the Vulnerable Software and Affected Versions: Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway version v.TEWA-700G Description: The issue allows a local attacker to obtain sensitive information via the default password parameter. This is related to an Insecu...

PT-2023-26155 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions = 7.2.0 Description: Insecure default permissions in the Admin Web Client of Wing FTP Server allow for privilege escalation. Recommendations: For versions = 7.2.0, update to a version later than 7.2.0 to resolve the...

The vulnerability of the Eclipse Jersey framework, related to the creation of temporary files with insecure permissions, allows a perpetrator to disclose protected information.

The vulnerability of the Eclipse Jersey framework lies in the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow an attacker to disclose protected information...

Design/Logic Flaw

Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A Cybersecurity tag dated 20230522 for more details. This issue affects...

CVE-2021-27932

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

CVE-2021-27932

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

CVE-2021-27932

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

Design/Logic Flaw

Stormshield Network Security SNS VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions...

CVE-2021-27932

Stormshield Network Security (SNS) VPN SSL Client versions 2.1.0–2.8.0 are affected by insecure permissions (CVE-2021-27932). Root cause: insecure permissions as described in the CVE entry. Impact (per CVSS v3.1 in the entry): high confidentiality, integrity, and availability with a base score of...

Information Exposure

Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Information Exposure. The ImpactActiveSupport::EncryptedFile method writes contents that will be encrypted to a temporary file...

TSplus 安全漏洞

TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus version 16.0.0.0, which originates from setting insecure file and folder permissions, which could allow a malicious user to manipulate the contents of a file e.g., change the code of an html page or...

TSplus 安全漏洞

TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus version 16.0.2.14, which originates from setting insecure file and folder permissions, which could allow a malicious user to manipulate the contents of a file e.g., change the code of an html page o...