CVE-2024-9950-PoC

CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07 Dettaglio Il mio blog Informazioni Vulnerabilità: Creazione di uno script temporaneo in una directory con permessi non sicuri Gravità: Da media ad alta Vettore: Macchina locale Windows Complessità dell'attacco: Bassa Privilegi richiesti: Bassi...

EUVD-2026-68059

The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to...

Linux Distros Unpatched Vulnerability : CVE-2026-56854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and...

EUVD-2026-42985

Snipe-IT has an Improper Privilege Management issue...

CVE-2025-68721

CVE-2025-68721: Axigen WebAdmin Gebrochene Zugriffskontrolle Zusammenfassung der Sicherheitslücke Ein Fehler in der Berechtigungslogik erlaubt es einem Administratorkonto mit null Berechtigungen , auf die Seite „Security & Filtering" zuzugreifen, insbesondere auf den Endpunkt für SSL-Zertifikate...

CVE-2025-70341

CVE-2025-70341: Permissões Inseguras + Execução Arbitrária de Código no App-Auto-Patch Resumo O App-Auto-Patch v3.4.2 cria seu diretório de trabalho com permissões graváveis por qualquer usuário chmod 777, possibilitando uma condição de corrida TOCTOU time-of-check-time-of-use local. Um atacante...

CVE-2023-46870

CVE-2023-46870 Nordic Semiconductor nRF Sniffer for Bluetooth LE versionen 3.0.0, 3.1.0, 4.0.0, 4.1.0 und 4.1.1 haben falsche Dateiberechtigungen gesetzt, was es Angreifern ermöglicht, eine Privilegienausweitung und Codeausführung durchzuführen, indem sie Bash- und Python-Skripte modifizieren...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-82239

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper (CVE-2025-58457)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper Vulnerability Details CVEID:CVE-2025-58457 DESCRIPTION: Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and resto...

CVE-2026-59292

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

EUVD-2026-67180

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-81682

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

EUVD-2026-67038

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-61790

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global...