Default configuration

An Incorrect Default Permissions CWE-276 vulnerability exists in SoMachine Basic, all versions, and Modicon M221all references, all versions prior to firmware V1.10.0.0 which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic...

CVE-2018-7822

The CVE-2018-7822 entry describes an Incorrect Default Permissions (CWE-276) vulnerability in Schneider Electric SoMachine Basic (all versions) and Modicon M221 prior to firmware v1.10.0.0. The root cause is improper default permissions on SoMachine Basic resource files on the system hosting SoMa...

GOG Galaxy Games directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s “Games” directory. An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. Tested Versions Gog...

ICSA-18-226-01 Siemens SIMATIC STEP 7 and SIMATIC WinCC (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable locally/low skill level to exploit Vendor: Siemens Equipment: SIMATIC STEP 7 TIA Portal and SIMATIC WinCC TIA Portal Vulnerabilities: Incorrect Default Permissions 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

AzeoTech DAQFactory

CVSS v3 7.1 ATTENTION: Local access and user-level privileges are required to exploit these vulnerabilities Vendor: AzeoTech Equipment: DAQFactory Vulnerabilities: Incorrect Default Permissions, Uncontrolled Search Path Element AFFECTED PRODUCTS AzeoTech reports that the vulnerabilities affect th...

Schneider Electric Wonderware InduSoft Web Studio 8.0 Patch 3 Insecure Permissions Vulnerability

Schneider Electric Wonderware InduSoft Web Studio versions 8.0 Patch 3 and below suffer from having incorrect default permissions. Vendor: Schneider Electric Equipment: Wonderware InduSoft Web Studio Vulnerability: Incorrect Default Permissions Advisory URL:...

webnetseo CMS Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title : webnetseo CMS Multiple Vulnerabilities Exploit Author : Ashiyane Digital Security Team Vendor Homepage: webnetseo.net Date : 2017 07 May Category : WebApp MY HOME : Ashiyane.org CWE : CWE-89 - CWE-276 And ... Video :...

Hide.Me VPN Client 1.2.4 - Local Privilege Escalation

Hide.Me VPN Client 1.2.4 - Local Privilege Escalation Title: Hide.Me VPN Client - EoP: User to SYSTEM CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: eVenture Product: Hide.Me VPN Client Version: 1.2.4 Download link: https://hide.me/en/software/windows Tested on: Window...

Accellion File Transfer Appliance (FTA) contains multiple vulnerabilities

Overview The Accellion File Transfer Appliance FTA contains multiple vulnerabilites that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Accellion File Transfer appliance contains multiple vulnerabilities in versions below...

Multiple ANTlabs InnGate models allow unauthenticated read/write to filesystem

Overview ANTlabs InnGate is a gateway device designed for operating corporate guest/visitor networks. Multiple models and firmware versions of the InnGate has been shown to allow read/write access to remote unauthenticated users via a misconfigured rsync instance. Description CWE-276: Incorrect...

Asseco SEE iBank FX Client 2.0.93 Privilege Escalation

Asseco SEE iBank FX Client = 2.0.9.3 Local Privilege Escalation Vulnerability Vendor: Asseco SEE Product web page: http://www.asseco.com Affected version: 2.0.9.3 Build 22.06.2011 - Desktop/Enterprise Edition 1.2 1.1.5.1270 Service Pack 5 - Desktop Edition 1.1.5.1247 1.0 Application download...

Asseco SEE iBank FX Client 2.0.9.3 - Local Privilege Escalation

Asseco SEE iBank FX Client 2.0.9.3 - Local Privilege Escalation Asseco SEE iBank FX Client = 2.0.9.3 Local Privilege Escalation Vulnerability Vendor: Asseco SEE Product web page: http://www.asseco.com Affected version: 2.0.9.3 Build 22.06.2011 - Desktop/Enterprise Edition 1.2 1.1.5.1270 Service...

Asseco SEE iBank FX Client 2.0.9.3 - Local Privilege Escalation

Asseco SEE iBank FX Client = 2.0.9.3 Local Privilege Escalation Vulnerability Vendor: Asseco SEE Product web page: http://www.asseco.com Affected version: 2.0.9.3 Build 22.06.2011 - Desktop/Enterprise Edition 1.2 1.1.5.1270 Service Pack 5 - Desktop Edition 1.1.5.1247 1.0 Application download...

Eventum 2.3.4 - 'hostname' Remote Code Execution

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...