PT-2025-140: Local Privilege Escalation in Alpha.Diagnostics

The vulnerability was identified in Alpha.Diagnostics, versions 2.2.3.13. The discovered vulnerability allows an attacker to to achieve local privilege escalation LPE due to misconfigured permissions on the folder from which a system service is started. Vulnerability status: Confirmed by vendor...

CVE-2025-48067

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the...

External Control of File Name or Path

Overview OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to External Control of File Name or Path via the upload endpoints. An attacker with the FILEUPLOAD permission can move files from the host into the upload folder, from where they can ...

GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

📄 Microsoft Windows 11 Version 24H2 Privilege Escalation

This vulnerability affects Microsoft Windows 11 various versions including 24H2, 23H2, and 22H2 and Windows Server 2025. It targets an improper access control in the Windows Cross Device Service, allowing a low-privileged local attacker to overwrite a critical DLL file...

CVE-2025-48961

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 Windows before build 39938...

FreeScout Security Bypass Vulnerability (CNVD-2025-20796)

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability that is caused by incorrect configuration of the root folder of the object Storage. An attacker could exploit the...

CVE-2025-48961

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 Windows before build 39938...

CVE-2025-48961

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 Windows before build 39938...

CVE-2025-48961

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 Windows before build 39938...

CVE-2025-48961

CVE-2025-48961 affects Acronis Cyber Protect 16 (Windows) prior to build 39938, with local privilege escalation caused by insecure folder permissions. The vulnerability is tied to the stated affected product/version and root cause; exploitation details are not provided in the connected documents....

Local privilege escalation due to insecure folder permissions

...

Acronis Cyber Protect security vulnerabilities

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Switzerland. Combining backup, anti-malware, cybersecurity and endpoint management features such as vulnerability assessment, URL filtering, patch management, etc. A security vulnerability...

CVE-2025-48961: Incorrect Permission Assignment for Critical Resource

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 Windows before build 39938...

PT-2025-23804 · Acronis · Acronis Cyber Protect 16

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 16 Windows versions before build 39938 Description: The issue is related to local privilege escalation due to insecure folder permissions. Recommendations: For Acronis Cyber Protect 16 Windows versions before build 39938...

📄 Adapt CMS 3.0.3 Remote Shell Upload

Adapt CMS version 3.0.3 suffers from a remote shell upload vulnerability. Exploit Title: Authenticated File Upload to RCE - adaptcmsv3.0.3 Date: 06/2025 Exploit Author: Andrey Stoykov Version: 3.0.3 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ Authenticated File Upload to RCE 1:...

GHSA-3PX7-C4J3-576R Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions v0alpha1, v1alpha1, v2alpha1. Impact: - Viewers can view all dashboards/folders regardless of permissions -...

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions

A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions v0alpha1, v1alpha1, v2alpha1. Impact: - Viewers can view all dashboards/folders regardless of permissions -...

Authorization Bypass in Dashboard API in Grafana

A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions v0alpha1, v1alpha1, v2alpha1. Impact: This vulnerability is present in 11.6.0, and 11.6.1 and fixed in...

SUSE-SU-2025:01660-2 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 128.10.1. Security fixes: - MFSA 2025-34 bsc1243216 CVE-2025-3875: Sender Spoofing via Malformed From Header in Thunderbird. CVE-2025-3877: Unsolicited File Download, Disk Space Exhaustion, and Credential...