CVE-2024-34221

Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation...

CVE-2024-36795

Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.541.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecified vectors...

CVE-2024-35102

Insecure Permissions vulnerability in VITEC AvediaServer Model avsrv-m8105 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script...

CVE-2024-56973

Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component...

CVE-2024-56973

Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component...

CVE-2025-22918

Polycom RealPresence Group 500 =20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user information...

CVE-2024-57520

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the actioncreateconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory aka directory traversal...

CVE-2022-25992

Insecure inherited permissions in the IntelR oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-57520

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the actioncreateconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory aka directory traversal...

CVE-2024-7612

Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components...

CVE-2024-29821

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-10251

Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9167

Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-2175

An insecure permissions vulnerability was reported in Lenovo Display Control Center LDCC and Lenovo Accessories and Display Manager LADM that could allow a local attacker to escalate privileges...

CVE-2024-11598

Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-57520

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the actioncreateconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory aka directory traversal...

CVE-2024-57520

CVE-2024-57520 affects Asterisk v22 with an Insecure Permissions vulnerability in the action_createconfig function that could allow a remote attacker to execute arbitrary code. The supplier disputes the impact, noting the effect may be limited to creating empty files outside the Asterisk product ...

CVE-2024-57520

Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the actioncreateconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory aka directory traversal...

PT-2025-5774 · Asterisk +1 · Asterisk +1

Name of the Vulnerable Software and Affected Versions: Asterisk version 22 Description: The issue allows a remote attacker to execute arbitrary code via the action createconfig function. This is due to an insecure permissions vulnerability. Recommendations: For Asterisk version 22, as a temporary...