puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

Default configuration

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-12441

The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...

CVE-2018-17872

Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions...

CVE-2018-17872

Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions...

Information disclosure

Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions...

CVE-2018-17872

Verba Collaboration Compliance and Quality Management Platform (Product by Verint/Verba) before version 9.2.1.5545 has Insecure Permissions (Improper Access Control). Public advisories and CVE entries indicate affected versions include

CVE-2018-17872

Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions...

sos-collector information disclosure vulnerability

sos-collector is a utility program for collecting sosreport from multiple nodes. A security vulnerability exists in sos-collector that stems from the program's failure to properly set the default permissions for newly created files, resulting in a local user being able to read all files created b...

Lone Wolf loadingDOCS Insecure Permissions

EZMAX SECURITY ADVISORY https://www.ezmax.ca/ Product: Loading Docs Vendor: Lone Wolf Technologies http://www.lwolf.com CVE ID: CVE-2018-15502 NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-15502 Subject: Insecure permissions allow remote attackers to download any confidential files via http...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

Code injection

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

CVE-2018-15502

The CVE-2018-15502 entry concerns Lone Wolf Technologies loadingDOCS. An insecure permissions flaw in the 2018-08-13 version allows remote attackers to download confidential files by issuing HTTPS requests to predictable URLs. The root cause is inadequate access controls on resources, enabling un...

CVE-2018-15502

Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs...

Design/Logic Flaw

TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function getpackagename in the file kernel/src/tbfheader.rs, variable "pub packagename: &'static str," in the file process.r...

CVE-2018-1000660

TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function getpackagename in the file kernel/src/tbfheader.rs, variable "pub packagename: &'static str," in the file process.r...

CVE-2018-1000660

TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function getpackagename in the file kernel/src/tbfheader.rs, variable "pub packagename: &'static str," in the file process.r...

PLANEX CS-QR20 Hardcoded Credential

Reserved CVE: CVE-2017-12577 Description A hardcoded account / password is used in the Android application that allows attackers to leverage hidden functions and execute arbitrary code on the device. Vulnerability Type Insecure Permissions Affected Product Code Base Firmware ver 1.30 Affected...