1729 matches found
PT-2025-31293 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 Description: A permissions issue existed that allowed a malicious application to potentially gain root privileges. The issue was addressed by removing...
CVE-2025-45467
Unitree Go1 = Go120220511 is vulnerable to Insecure Permissions as the firmware update functionality via Wi-Fi/Ethernet implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation...
Replit AI Agent Deletes Sensitive Data Despite Explicit Instructions
Replit AI agent deleted data from 1,200+ executives and companies without permission, raising concerns about AI safety and control in live environments...
Azure Linux 3.0 Security Update: python3 (CVE-2024-4030)
The version of python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4030 advisory. - On Windows a directory returned by tempfile.mkdtemp would not always have permissions set to restrict readin...
Incorrect Default Permissions
Overview Affected versions of this package are vulnerable to Incorrect Default Permissions due to world-writable permissions set on SBOM files in the file system. An attacker can modify or delete SBOM files by gaining local access to the running image, which may confuse security scanners or disru...
CVE-2025-27613 Gitk can create and truncate files in the user's home directory
Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled...
PT-2025-29129 · Alteryx · Alteryx Server
Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: An insecure permissions issue in the local storage component of Alteryx Server allows remote attackers to obtain valid user session tokens from localStorage, potentially leading to account...
PT-2025-28376
Name of the Vulnerable Software and Affected Versions: Framework for Galaxy Watch versions prior to SMR Jul-2025 Release 1 Description: The issue is related to incorrect default permissions in the Framework for Galaxy Watch, allowing local attackers to reset some configurations of the Galaxy Watc...
CVE-2025-52992
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and...
CVE-2025-52992
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and...
Intelbras InControl 安全漏洞
Intelbras InControl is an access control management software from Intelbras that allows users to easily manage any ingress and egress traffic using access control devices. A security vulnerability exists in Intelbras InControl version 2.21.60.9, which stems from a file/v1/operador/permissions iss...
CVE-2025-52992
The CVE-2025-52992 entry covers a vulnerability in Nix, Lix, and Guix where permissions are not set correctly when a derivation build fails. Affected are Nix prior to 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix prior to 2.91.2, 2.92.2, and 2.93.1; and Guix prior to 1.4.0-38.0e79d5b. The underlying i...
CVE-2024-11584
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...
Arc 安全漏洞
Arc is a browser from Arc. A security vulnerability exists in versions prior to Arc 1.26.1 that stems from a site settings bypass issue that allows sites to add new permissions...
CVE-2024-52928
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites with previously granted permissions to add new permissions when the user clicks anywhere on the website...
CVE-2025-52878
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions...
TencentOS Server 2: firefox (TSSA-2024:0373)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0373 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2025-43697
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio DataMapper allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025...
CVE-2025-4128 Mattermost Guest User Information Disclosure Vulnerability
Mattermost versions 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/teamid...