CVE-2018-18931

An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the...

The vulnerability of the JunOS operating system arises from insecure access rights to key files exported using the “run request security pki key-pair export” command. This allows a malicious individual to gain unauthorized read and modify access to data.

The vulnerability of the JunOS operating system exists due to insecure access rights to key files, which are exported using the “run request security pki key-pair export” command. Exploiting this vulnerability can allow a malicious individual to gain unauthorized read and modify access to data...

X11 Mesa 3D Graphics Library shared memory permissions vulnerability

Summary An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library. An attacker can access the shared memory without any specific permissions to trigger this vulnerability. Tested Versions Mesa 3D X11 Graphics library 19.1.2 Product URLs...

CVE-2019-14737

Ubisoft Uplay 92.0.0.6280 has Insecure Permissions...

CVE-2019-14737

Ubisoft Uplay 92.0.0.6280 has Insecure Permissions...

Design/Logic Flaw

Ubisoft Uplay 92.0.0.6280 has Insecure Permissions...

CVE-2019-14737

Ubisoft Uplay 92.0.0.6280 has Insecure Permissions...

CVE-2019-14737

CVE-2019-14737 affects Ubisoft Uplay 92.0.0.6280, with insecure permissions in the Uplay installation folder that can lead to local privilege elevation. The NVD entry notes a local attacker with low complexity and no authentication could achieve high impact (C/H/I/A = High). Root cause: insecure ...

CVE-2019-14226

OX App Suite through 7.10.2 has Insecure Permissions...

CVE-2019-14226

OX App Suite through 7.10.2 has Insecure Permissions...

Design/Logic Flaw

OX App Suite through 7.10.2 has Insecure Permissions...

CVE-2019-14226

OX App Suite through 7.10.2 has Insecure Permissions...

CVE-2019-14226

Open-Xchange OX App Suite prior to fixes 7.10.2 has an insecure permissions issue in the backend affecting versions 7.10.1 and 7.10.2. The vulnerability allows partial confidentiality and integrity impact with no availability impact, and was addressed by vendor with fixed versions 7.10.0-rev33, 7...

Uplay 92.0.0.6280 - Local Privilege Escalation

Exploit Title: Uplay 92.0.0.6280 - Local Privilege Escalation Date: 2019-08-07 Exploit Author: Kusol Watchara-Apanukorn, Pongtorn Angsuchotmetee, Manich Koomsusi Vendor Homepage: https://uplay.ubisoft.com/ Version: 92.0.0.6280 Tested on: Windows 10 x64 CVE : N/A Vulnerability Description:...

CVE-2019-0073

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D18...

CVE-2019-0073

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D18...

Razer: [razer-assets2] Listing of Amazon S3 Bucket accessible to any AWS cli

The tester determined that an S3 bucket had insecure permissions. No customer data was in danger, but thee was the potential for some Razer product collateral to be prematurely leaked, so Razer secured this bucket out of caution. Full writeup over at...

CVE-2019-3688

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

CVE-2018-19592

The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441...

Design/Logic Flaw

The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441...