CVE-2021-28623

Adobe Premiere Elements 5.2 and earlier are affected by an insecure temporary file creation vulnerability that allows privilege escalation. The root cause is the creation of temporary files in directories with incorrect permissions, enabling an unauthenticated attacker to call installer functions...

CVE-2021-28623 Adobe Premiere Elements Privilege Escalation Vulnerability

Adobe Premiere Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-20490

IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791...

IBM Spectrum Protect Plus 安全漏洞

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

CVE-2021-0536

In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

ZOLL Defibrillator Dashboard Permission Mismanagement Vulnerability

ZOLL Defibrillator Dashboard is a defibrillator management tool. A mismanagement of privileges vulnerability exists in ZOLL Defibrillator Dashboard versions prior to 2.2. The vulnerability stems from the product containing insecure file system permissions. An attacker could exploit the...

ZOLL Defibrillator Dashboard 安全漏洞

ZOLL Defibrillator Dashboard is a defibrillator management tool. A mismanagement of privileges vulnerability exists in ZOLL Defibrillator Dashboard versions prior to 2.2. The vulnerability stems from the product containing insecure file system permissions. An attacker could exploit the...

CVE-2021-33669

Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and...

CVE-2021-33669

Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and...

WordPress和Fancy Product Designer 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A code issue exists in the WordPress plugin Fancy Product Designer, which originates from "wp-admin" or...

CVE-2018-16494

In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa...

netty: Information disclosure via the local system temporary directory

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...

Adobe Genuine Integrity Service 输入验证错误漏洞

Adobe Genuine Service is a free service that periodically verifies that the Adobe applications on your computer are genuine and notifies customers if they are not. An insecure file permission vulnerability exists in Adobe Genuine Service 7.1 and earlier versions. An attacker could exploit the...

Splinterware System Scheduler Professional 5.30 - Unquoted Service Path Vulnerability

Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.splinterware.com Software Link: https://www.splinterware.com/download/ssproeval.exe Version: 5.30 Professional Tested on: Windows 10 Pro 20H2 x64...

CVE-2021-28568

Adobe Genuine Services version 7.1 and earlier is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the current user...

Insecure Temporary File And Folder

openapi-generator-online uses insecure temporary file and folder. The usage of Files.createTempFile to create temporary files and folders allows auto-generated files to be read and modified by any user on the system...

CVE-2021-28168

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

CVE-2020-27568

Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All Aviatrix appliances are fully encrypted. This is an extra layer of security...

CVE-2020-27568

Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All Aviatrix appliances are fully encrypted. This is an extra layer of security...

CVE-2020-27568

The CVE-2020-27568 entry concerns Aviatrix Controller 5.3.1516 with insecure file permissions. The issue is caused by the presence of world-writable files and directories in the controller resource, as noted in multiple sources. The information provided does not include specific vulnerable compon...