CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78553

RansomLook stored its Flask session-signing key in a secret_key file with default file permissions (e.g., 0644 under a common 022 umask) rather than explicitly restricting access. Any local user able to read the RansomLook home directory could obtain this cryptographic secret, which is used to si...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-78553 Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

EUVD-2026-65089

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2025-68825

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...

CVE-2025-68825 HCL Hive is affected by incorrect default permissions

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...

EUVD-2025-210763

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...

CVE-2025-68825

HCL Hive is affected by incorrect default permissions that can be exploited over the network without prior authentication (CVSS 7.5, HIGH). The vulnerability enables unauthorized lateral movement , container breakout , and interception of sensitive internal communications , with the primary impac...

Astra Linux – Vulnerability in targetcli-fb

The Open-iSCSI TargetCLI-fb version up to 2.1.52 has weak permissions for the /etc/target directory as well as for the backup directory and backup files...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: rc: The bpf attach/detach operation requires write permission. source-iocs-preserved const=CAPNETADMIN...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30607 – Use after free in Permissions...

Astra Linux – Vulnerability in WebKit2GTK

A permissions issue has been addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4, and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack...

Astra Linux – Vulnerability in Firefox and Thunderbird

An iframe from a cross-origin origin that references an XSLT document would inherit the permissions of the parent domain such as access to microphones or cameras. This vulnerability affects Thunderbird 102.2, Thunderbird 91.13, Firefox ESR 91.13, Firefox ESR 102.2, and Firefox 104...

Astra Linux – Vulnerability in Firefox

Spoofing issue in the Site Permissions component. This vulnerability has been fixed in Firefox 143 and Thunderbird 143...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging broker. In rabbitMQ-server prior to version 3.8.17, adding a new user through the management UI could result in the user’s banner being displayed in a confirmation message without proper tag sanitization. This could potentially allow for JavaScript code to...

Astra Linux – Vulnerability in libzstd

Starting from v1.4.1 and before v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and immediately restricted those permissions afterward. As a result, the output files could temporarily be readable or writable by...

Astra Linux – Vulnerability in Linux

The arch/x86/kvm/mmu/pagingtmpl.h file in the Linux kernel before version 5.12.11 incorrectly calculates the access permissions of a shadow page, resulting in a missing guest protection page fault...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Audacity

In Audacity version 2.3.3, temporary files are saved to the /var/tmp/audacity-$USER directory by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary .au audio files located there...