CVE-2025-32797 Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

CVE-2025-32797

Conda-build before 25.3.1 creates a temporary build script (conda_build.sh) with overly permissive 0o766 permissions. A local attacker with filesystem access can race between creation and execution to overwrite the script, enabling arbitrary code execution under the victim’s privileges. Fedora an...

CVE-2025-3473

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

PT-2025-25368

Name of the Vulnerable Software and Affected Versions Apport affected versions not specified Description The process crash function within the data/apport component of the Apport crash reporting tool may create crash files with incorrect group ownership. This could lead to the exposure of crash...

CVE-2025-3473

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

CVE-2025-3473

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

CVE-2025-3473

Summary: CVE-2025-3473 affects IBM Guardium Data Protection (11.5 and 12.1). A local privileged user can escalate to root due to insecure inherited permissions created by the program (CWE-277). The base CVSS v3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). IBM’s security bulletin confirms...

CVE-2025-3473 IBM Security Guardium privilege escalation

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

CVE-2025-3473 IBM Security Guardium privilege escalation

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

PT-2025-25217 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium version 12.1 Description: The issue allows a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program. Recommendations: For IBM Security Guardium version 12....

Insecure Inherited Permissions

Overview django-helpdesk is a Django-powered ticket tracker for your helpdesk Affected versions of this package are vulnerable to Insecure Inherited Permissions due to the improper setting of os.umask0 in models.py. An attacker can access sensitive data without proper authorization by exploiting...

GHSA-G88V-2J67-9RMX Fess has Insecure Temporary File Permissions

Summary Fess an open-source Enterprise Search Server creates temporary files without restrictive permissions, which may allow local attackers to read sensitive information from these temporary files. Details The createTempFile method in org.codelibs.fess.helper.SystemHelper creates temporary file...

CVE-2025-48382 Fess has Insecure Temporary File Permissions

Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local...

CVE-2025-45468

Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account...

CVE-2025-45471

Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account...

CVE-2025-48070

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site...

CVE-2024-40087

Vilo 5 Mesh WiFi System = 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router...

CVE-2024-38456

HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in prunsrv.exe. A regular user non-admin can exploit the weak folder and file permissions to escalate privileges and execute arbitrary code in the...

CVE-2024-25561

Insecure inherited permissions in some IntelR HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-33892

Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3...