qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

EUVD-2024-55764

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

CVE-2024-58383

Froxlor before 2.2.0 (including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via XML config templates in lib/configfiles/, despite the file containing the Froxlor SQL user's password. On systems with world-readable parent directories (default on Debian 12), any unprivileged lo...

LDAP-Password-Hunter

LDAP Password Hunter レガシーサービスの要件や単にセキュリティの悪い慣行により、認証可能なユーザーであれば誰でもLDAPデータベース内のパスワードがワールドリーダブルになることがあります。 LDAP Password...

EUVD-2026-76737

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2026-90457

CVE-2026-90457 involves an inconsistency in administrative password hashing across authentication paths in an ICS product (per CISA advisory ICSA-26-254-01). One path uses a weak, fast hashing algorithm , and the resulting hash file is written with permissions readable by any local user . A separ...

PT-2026-90526

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

CVE-2020-10977

用于 GitLab 私有实例任意文件读取的 Python 漏洞利用程序 在 2020 年 3 月 23 日，William Bowling 在 hackerone 上发布了一份带有 PoC 的漏洞报告。 借助此漏洞，我们可以读取 GitLab 服务器上任何全局可读的文件（权限为 444 或更高），例如 /etc/passwd 等……（仅限全局可读文件）\ root@kitploit: Notice that you should be authenticated user 我已在 GitLab 21.9.0 版本（Ubuntu 18.04）上进行了测试，但它与操作系统无关...

TencentOS Server 4: libvirt (TSSA-2026:0978)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0978 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-59292

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

EUVD-2026-67180

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59292

CVE-2026-59292 affects Spring Integration , where the default file-based PropertiesPersistingMetadataStore persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions , allowing local users with high privileges to read metadata. The CVSS 3....

CVE-2026-81682

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81683

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

CVE-2026-81682

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

EUVD-2026-67039

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...