Creation of Temporary File With Insecure Permissions

Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions due to data written to RUN --mount=type=bind mounts during the podman build not being discarded. An attacker can gain unauthorized access to sensitive files by exploiting the exposure...

CVE-2025-7355 IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CVE-2025-55111 BMC Control-M/Agent insecure default file permissions

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

CVE-2025-55111

CVE-2025-55111 affects BMC Control-M/Agent; out-of-support versions 9.0.18–9.0.20 and some earlier/upgraded newer versions contain files with overly permissive permissions that store SSL keys, keystores, and policy passwords. An attacker with local access can read these files. The connected sourc...

CVE-2025-55111 BMC Control-M/Agent insecure default file permissions

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating ...

Insecure Deserialization

picklescan is vulnerable to Insecure Deserialization. The vulnerability is due to the use of torch.utils.collectenv.run function to execute remote pickle files, which allows an attacker to execute arbitrary code...

CYRISMA Sensor 安全漏洞

CYRISMA Sensor is a scanning and detection component from CYRISMA USA. A security vulnerability exists in versions prior to CYRISMA Sensor 444, which stems from insecure folder and file permissions that could allow a low-privileged user to elevate privileges by replacing binaries and executing...

GitHub's Copilot Code Review: Can AI Spot Security Flaws Before You Commit?

As software development practices increasingly adopt AI-powered tools, ensuring that such tools can support secure coding has become critical. This study evaluates the effectiveness of GitHub Copilot's recently introduced code review feature in detecting security vulnerabilities. Using a curated...

CVE-2025-57625

CYRISMA Sensor for Windows versions before 444 contains an insecure folder and file permissions flaw that lets a low-privilege user replace DataSpotliteAgent.exe (or other binaries invoked by the Cyrisma_Agent service at startup) and escalate to NT AUTHORITY\SYSTEM, enabling arbitrary code execut...

CVE-2025-57625

CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by...

PT-2025-38068

Name of the Vulnerable Software and Affected Versions: CYRISMA Sensor versions prior to 444 Description: CYRISMA Sensor before version 444 for Windows contains an Insecure Folder and File Permissions vulnerability. A low-privileged user can exploit this issue to escalate privileges and execute...

PT-2025-38083

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS affected versions not specified Description: A flaw exists in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration ZCS that allows an attacker with valid user credentials to bypass Two-Factor...

CVE-2025-57625

CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by...

CVE-2025-59328

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service DoS. The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during...

CVE-2025-59328 Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service DoS. The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during...

CVE-2025-3025

Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before 6.36.11508...

CVE-2025-3025 CCleaner Link Following Local Privilege Escalation Vulnerability

Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before 6.36.11508...

CVE-2025-3025 CCleaner Link Following Local Privilege Escalation Vulnerability

Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before 6.36.11508...

CVE-2025-3025

Gen Digital CCleaner for Windows is affected by CVE-2025-3025 through insecure file deletion in the Cleaning feature. The root cause is unsafe deletion operations that enable a local user to escalate to SYSTEM privileges (reported on CCleaner v6.33.11465; affected before v6.36.11508). Exploitatio...

Insecure Deserialization

picklescan is vulnerable to insecure deserialization. The vulnerability is due to the use of torch.utils.bottleneck.main.runcprofile function to execute remote pickle files, which allows an attacker to run arbitrary code...