CVE-2025-45157

Summary: CVE-2025-45157 affects Splashin iOS v2.0, where insecure permissions could allow unauthorized access to users’ location data. The publicly documented impact is “location data leakage” with a CVSS v3.1 base score of 6.5 (Medium). Reported information consistently states the issue but prov...

PT-2025-30064 · Splashin · Splashin

Name of the Vulnerable Software and Affected Versions: Splashin iOS version 2.0 Description: Insecure permissions allow unauthorized attackers to access location data for specific users. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Detecting and Visualizing Lateral Movement Attacks with Trellix XDR

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect By Maulik Maheta and Adithya Chandra · July 17, 2025 Executive summary This blog marks the third installment in our series on detecting and visualizing lateral movement attacks with Trellix Helix Connect. A lateral...

CVE-2025-36104

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol...

CVE-2025-36104 IBM Storage Scale information disclosure

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

CVE-2025-52364

Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service telnetd by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if...

PT-2025-29322 · Ibm · Ibm Storage Scale

Name of the Vulnerable Software and Affected Versions: IBM Storage Scale versions 5.2.3.0 and 5.2.3.1 Description: IBM Storage Scale versions 5.2.3.0 and 5.2.3.1 may allow an authenticated user to obtain sensitive information from files due to insecure permissions inherited through the SMB...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

CVE-2025-52364

Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service telnetd by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if...

CVE-2025-52364

Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service telnetd by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if...

CVE-2025-52364

Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service telnetd by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if...

CVE-2025-52364

CVE-2025-52364 affects Tenda CP3 Pro firmware 22.5.4.93. The issue is an insecure permissions configuration that leaves telnetd enabled by default at boot via /etc/init.d/eth.sh, allowing remote connection to the device shell over the network and potentially without authentication if default or w...

CVE-2025-52364

Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service telnetd by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if...

CVE-2025-24006

A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root...

BIT-CONTOUR-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

BIT-CERT-MANAGER-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2025-5995

CVE-2025-5995 affects Canon EOS Webcam Utility Pro for macOS, with versions 2.3d (2.3.29) and earlier vulnerable due to improper directory permissions. An attacker with administrator privileges could modify the target directory, potentially enabling code execution and privilege escalation. Mitiga...

kea: Insecure file permissions can result in confidential information leakage

A vulnerability was found in the Kea package, where an attacker with access to a local unprivileged user may be able to read the logs and DHCP lease information. This can be used to retrieve sensitive information about the DHCP clients and about the Kea process itself...