cnlh nps vulnerable to file overwrite by local user

lib/install/install.go in cnlh nps prior to 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...

CVE-2022-28999

Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe...

CVE-2022-28999

Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe...

Design/Logic Flaw

Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute arbitrary code via overwriting binaries located in the directory...

Design/Logic Flaw

Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe...

CVE-2022-29376

CVE-2022-29376 concerns Xampp for Windows, affected in version 8.1.4 and below. The root issue is insecure permissions on the install directory, which could let an attacker overwrite binaries and execute arbitrary code. The NVD entry notes high-severity impact (CVSSv3.1: 8.8, network attack, no u...

CVE-2022-29376

Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute arbitrary code via overwriting binaries located in the directory...

CVE-2022-28999

Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe...

CVE-2022-28999

CVE-2022-28999 concerns Dev-CPP v4.9.9.2 where insecure permissions in the installation directories and binaries (notably devcpp.exe) allow overwriting the binary to execute arbitrary code. Affected software: Dev-CPP 4.9.9.2. Root cause: insecure install/public write permissions enabling tamperin...

CVE-2022-28932

D-Link DSL-G2452DG HW:T1\tFW:ME2.00 was discovered to contain insecure permissions...

CVE-2022-28932

D-Link DSL-G2452DG HW:T1\tFW:ME2.00 was discovered to contain insecure permissions...

CVE-2022-28932

D-Link DSL-G2452DG HW:T1\tFW:ME2.00 was discovered to contain insecure permissions...

CVE-2022-28932

CVE-2022-28932 affects the D-Link DSL-G2452DG router (firmware ME 2.00). The issue is insecure permissions in the implementation of the execute cmd.cgi script, which could allow an attacker to run arbitrary commands due to improper permission handling. The PT-2022-3217 entry documents this as a v...

XAMPP 安全漏洞

XAMPP is an integrated installation package for apache, PHP, Perl and MySQL from the US-based Apache Friends team. The product is mainly used to build web servers. A security vulnerability exists in XAMPP version 7.4.28 version 8.0.17 and 8.1.4 and earlier versions, which stems from the applicati...

Embarcadero Technologies Dev-CPP 安全漏洞

Embarcadero Technologies Dev-CPP is a free, all-in-one development environment for C/C++ development from Embarcadero Technologies, USA. A security vulnerability exists in Embarcadero Technologies Dev-CPP version v4.9.9.2, which stems from insecure permissions in the installation directory and...

Information disclosure

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 Linux before build 29240, Acronis Agent Linux before build 28037...

Insecure temporary file usage in Jenkins Git Client Plugin

Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

GHSA-MF7C-35MQ-75PJ Insecure Inherited Permissions in Apache Hadoop

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user...

Creation of Temporary File With Insecure Permissions in logilab-commons

The Execute class in shellutils in logilab-common before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...