4321 matches found
EUVD-2026-13865
Halloy is an IRC application written in Rust. In versions on \nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in 0644 on files and 0755 on directories. This allows any...
Insecure Temporary File
Overview @capgo/cli is an A CLI to upload to capgo servers Affected versions of this package are vulnerable to Insecure Temporary File via unsafe file operations that follow symlinks and do not enforce secure permissions. An attacker can overwrite arbitrary files or expose sensitive credential...
EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-1572)
According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and...
GHSA-VR7J-G7JV-H5MP OpenClaw session transcript files were created without forced user-only permissions
openclaw created new session transcript JSONL files with overly broad default permissions in affected releases. On multi-user hosts, other local users or processes could read transcript contents, including secrets that might appear in tool output. Affected Packages / Versions - Package: openclaw...
CVE-2016-20025
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with...
CVE-2016-20025
CVE-2016-20025 affects ZKTeco ZKAccess Professional 3.5.3. The issue is an insecure file-permissions vulnerability where the Modify permission granted to the Authenticated Users group lets authenticated users replace executable binaries, enabling privilege escalation. Documented impact includes p...
CVE-2016-20025 ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with...
CVE-2016-20025 ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with...
CVE-2016-20024
The CVE-2016-20024 issue affects ZKTeco ZKTime.Net product lines, notably 3.0.1.6 (and related versions 3.0.1.5/3.0.1.1 per sources). The root cause is insecure file permissions: world-writable rights on the ZKTimeNet3.0 directory and its contents allow unprivileged users to replace executable fi...
PT-2026-25665
Name of the Vulnerable Software and Affected Versions ZKTeco ZKAccess Professional version 3.5.3 Description The software contains an insecure file permissions issue that allows authenticated users to escalate privileges. Attackers can exploit the Modify permission granted to the Authenticated...
PT-2026-25664
Name of the Vulnerable Software and Affected Versions ZKTeco ZKTime.Net version 3.0.1.6 Description The software contains an insecure file permissions issue that allows users with limited access to gain higher privileges. This is possible by altering executable files. Attackers can take advantage...
CVE-2025-70341
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files...
EUVD-2025-208271
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files...
CVE-2025-70341
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files...
CVE-2026-28778 Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100
International Datacasting Corporation IDC SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the xd user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the xd user has write permissions to their home...
CVE-2026-28778
IDC SFX Series SuperFlex Satellite Receiver (IDC SFX2100) exposes undocumented hardcoded credentials for the xd user, enabling remote FTP access. The xd user’s home directory contains root‑executed binaries and related symlinks (e.g., xdstartstop); an unauthenticated attacker could overwrite file...
CVE-2026-28778 Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100
International Datacasting Corporation IDC SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the xd user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the xd user has write permissions to their home...
App Auto-Patch 安全漏洞
App Auto-Patch is an open-source tool developed by App Auto-Patch for automating the patching of Mac applications. Version 3.4.2 of App Auto-Patch contains a security vulnerability, which stems from insecure permissions, potentially allowing attackers to write arbitrary files...
