CVE-2019-11244 kubectl creates world-writeable cached schema files

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

PT-2019-6663

Name of the Vulnerable Software and Affected Versions Ubuntu SELinux initscript versions prior to 1:0.10 Description The issue arises from the Ubuntu SELinux initscript creating a lockfile in a world-writable directory using the touch command. If the OS kernel lacks symlink protections, an attack...

CVE-2019-11244: Use of Cache Containing Sensitive Information

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-8453

Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client...

Oracle JD Edwards Products JD Edwards World Technical Foundation Access Control Error Vulnerability

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle. The product provides financial management, project management and asset lifecycle management application modules. A security vulnerability exists in the Service Enablement...

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

In kubectl v1.8.0+, schema info is cached in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be...

Samba 4.9.x < 4.9.6 / 4.10.0 < 4.10.2 World-Writable Files Vulnerability (CVE-2019-3870)

The version of Samba running on the remote host is 4.9.x 4.9.6 or 4.10.0 prior to 4.10.2. It is, therefore, potentially affected by a world writable files vulnerability. An authenticated, local attacker can exploit this issue to read and update files in the private/ directory. Note that Nessus ha...

PT-2019-2022

Name of the Vulnerable Software and Affected Versions JD Edwards World Technical Foundation versions A9.2, A9.3.1, A9.4 Description The issue is related to inadequate access control in the Service Enablement component of JD Edwards World Technical Foundation. This can be exploited by a remote...

Shenzhen with the world Technology Co., Ltd. series of station building system with xss vulnerability

Shenzhen with the world technology limited company is a travel agency SaaS intelligent management system research and development, sales and the establishment of industry data center as one of the new Internet enterprises. Ltd. series of website building system xss vulnerability, attackers can us...

CVE-2019-3891

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...

DEBIAN-CVE-2019-3870

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

AZL-45057 CVE-2019-3870 affecting package samba for versions less than 4.18.3-1

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

Design/Logic Flaw

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

CVE-2019-3870

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

CVE-2019-3870

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

CVE-2019-3870

CVE-2019-3870 affects Samba 4.9 (inclusive) through 4.9.5, and 4.10.x up to 4.10.2. During new Samba AD DC creation, a private install subdirectory (often 0700) may be left with looser permissions (e.g., 0755) after upgrades. Within this directory, files are created with mode 0666, making sensiti...

CVE-2019-3870

A vulnerability was found in Samba versions 4.9 and later. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some upgraded installations it will have othe...

CVE-2019-3870: Incorrect Default Permissions

A vulnerability was found in Samba from version including 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner root only access. However in some...

World writable files in Samba AD DC private/ dir

Description During the creation of a new Samba AD DC, files are created in a the private/ subdirectory of our install location. This directory is typically mode 0700, that is owner root only access. However in some upgraded installations it will have other permissions, such as 0755, because this...