Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions

Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Privilege Escalation Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://www.inosoft.com/ Version: Up to 2022-2.1 Runtime RT7.3 RC3 20221209.5 Tested on: Windows CVE:...

CVE-2023-28658

Insecure inherited permissions in some IntelR oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-28658

Insecure inherited permissions in some IntelR oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-21880

Name of the Vulnerable Software and Affected Versions IntelR oneMKL versions prior to 2022.0 Description The issue is related to insecure inherited permissions in IntelR oneMKL software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-39004

Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...

CVE-2023-39005

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...

CVE-2023-39005

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...

CVE-2023-39003

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp...

CVE-2023-39003

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp...

Privilege escalation

Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...

Code injection

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...

CVE-2023-39003

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp...

PT-2023-26730 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to insecure permissions in the configuration directory /conf/ of OPNsense, allowing attackers to access...

PT-2023-26731 · Opnsense · Opnsense Business Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to insecure permissions for configd.socket. Recommendations: For OPNsense Community Edition versions prior ...

CVE-2023-39004

CVE-2023-39004 concerns insecure permissions in the OPNSense configuration directory (/conf/). Affected: OPNSense Community Edition prior to 23.7 and Business Edition prior to 23.4.2. Root cause: misconfigured directory permissions may allow attackers to read sensitive data (e.g., hashed root pas...

CVE-2023-39005

OPNsense CVE-2023-39005: Insecure permissions for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. This misconfiguration can expose high-confidentiality data access risk (per CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; base score 7.5). Publicly docu...

CVE-2023-39003

CVE-2023-39003 affects OPNSense Community Edition < 23.7 and OPNSense Business Edition

CVE-2023-39004

Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...

CVE-2023-39003

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp...

PT-2024-12816 · Mariadb Foundation +1 · Mariadb +1

Name of the Vulnerable Software and Affected Versions: MariaDB version 10.5 Description: Insecure permissions in the sys exec function of MariaDB allow authenticated attackers to execute arbitrary commands with elevated privileges. This issue is disputed by the MariaDB Foundation because no...