CVE-2025-52361

Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction...

PT-2025-31654 · Unknown · Langchain-Chatglm-Webui

Name of the Vulnerable Software and Affected Versions: LangChain-ChatGLM-Webui commit ef829 Description: An insecure permissions issue in LangChain-ChatGLM-Webui commit ef829 allows attackers to view and download sensitive files by submitting a crafted request. Recommendations: Address the insecu...

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request...

CVE-2025-45150

CVE-2025-45150 affects LangChain-ChatGLM-Webui (commit ef829). The issue is insecure permissions that could allow an attacker to arbitrarily view and download sensitive files via a crafted request. Public references across NVD, Red Hat, CVE databases and security trackers corroborate this vulnera...

CVE-2025-52361

Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction...

PT-2025-31647 · Unknown +1 · Ak-Nord Usb-Server-Lxl +1

Name of the Vulnerable Software and Affected Versions: AK-Nord USB-Server-LXL Firmware version 0.0.16 Build 2023-03-13 Description: Insecure permissions within the /etc/init.d/lighttpd script allow a locally authenticated low-privilege user to execute arbitrary commands with root privileges. This...

PT-2025-31541 · Undefined · Undefined

Array Networks vAPV version 8.3.2.17 and vxAG version 9.2.0.34 appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials or SSH private key and insecure permissions on a startup script. The devices ship with a default SSH login or a...

CVE-2025-0712 APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files,...

CVE-2025-45467

Unitree Go1 = Go120220511 is vulnerable to Insecure Permissions as the firmware update functionality via Wi-Fi/Ethernet implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation...

CVE-2025-45467

Unitree Go1 = Go120220511 is vulnerable to Insecure Permissions as the firmware update functionality via Wi-Fi/Ethernet implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation...

CVE-2025-45467

Unitree Go1 = Go120220511 is vulnerable to Insecure Permissions as the firmware update functionality via Wi-Fi/Ethernet implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation...

CVE-2025-45467

CVE-2025-45467 affects Unitree Go1 firmware (Go1_2022_05_11 and earlier). The vulnerability is an insecure firmware verification mechanism in the update process (via Wi‑Fi/Ethernet) that relies solely on MD5 checksums, enabling potential tampering of the official firmware. Reported impacts includ...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

PT-2025-30064 · Splashin · Splashin

Name of the Vulnerable Software and Affected Versions: Splashin iOS version 2.0 Description: Insecure permissions allow unauthorized attackers to access location data for specific users. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CVE-2025-45157

Summary: CVE-2025-45157 affects Splashin iOS v2.0, where insecure permissions could allow unauthorized access to users’ location data. The publicly documented impact is “location data leakage” with a CVSS v3.1 base score of 6.5 (Medium). Reported information consistently states the issue but prov...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

Detecting and Visualizing Lateral Movement Attacks with Trellix XDR

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect By Maulik Maheta and Adithya Chandra · July 17, 2025 Executive summary This blog marks the third installment in our series on detecting and visualizing lateral movement attacks with Trellix Helix Connect. A lateral...

CVE-2025-36104

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol...

CVE-2025-36104 IBM Storage Scale information disclosure

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol...