CVE-2025-10941

The CVE-2025-10941 entry concerns Topaz SERVCore Teller versions 2.14.0-RC2/2.14.1, where the vulnerability affects the Installer component (SERVCoreTeller_2.0.40D.msi). The issue is described as a local permission problem in the installer file that could enable a local privilege/permission manip...

PT-2025-39360

Name of the Vulnerable Software and Affected Versions Topaz SERVCore Teller versions 2.14.0-RC2 through 2.14.1 Description A local permission bypass issue exists in Topaz SERVCore Teller. The issue affects some unknown functionality within the SERVCoreTeller 2.0.40D.msi file of the Installer...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS. The vulnerabilities include several issues related to accessing sensitive user data, permissions, and security vulnerabilities that could lead to unauthorized access or bypassing sandbox restrictions. These vulnerabilities could be exploited by malicious...

CVE-2025-8797

A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the publi...

CVE-2025-8797

A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the publi...

CVE-2025-8797

A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the publi...

GHSA-W7QC-6GRJ-W7R8 File Browser vulnerable to command execution allowlist bypass

Summary The Command Execution feature of Filebrowser only allows the execution of shell command which have been predefined on a user-specific allowlist. The implementation of this allowlist is erroneous, allowing a user to execute additional commands not permitted. Impact A user can execute more...

CVE-2025-6765

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. Th...

CVE-2025-52992

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and...

CVE-2025-6765

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. Th...

CVE-2025-6765 Intelbras InControl HTTP PUT Request operador permission

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. Th...

CVE-2025-6765

CVE-2025-6765 affects Intelbras InControl 2.21.60.9, where the HTTP PUT Request Handler’s processing of the file at "/v1/operador/" can lead to permission issues. The vulnerability arises from how the endpoint handles PUT requests, enabling remote initiation with potential impact on permissions. ...

PT-2025-27146 · Intelbras · Intelbras Incontrol

Name of the Vulnerable Software and Affected Versions: Intelbras InControl version 2.21.60.9 Description: A critical issue has been found in the HTTP PUT Request Handler component, affecting the processing of the file "/v1/operador/". This leads to permission issues and can be initiated remotely...

CVE-2025-52992

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Remote Code Execution RCE and improper preservation of permissions due to jsonpath-plus & snowflake-sdk. Vulnerabilit...

CVE-2025-52878

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions...

GO-2025-3744 SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb

SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb...

CVE-2025-43697

CVE-2025-43697 is a Salesforce OmniStudio (DataMapper) issue described as Improper Preservation of Permissions, enabling exposure of encrypted data for affected records when field-level permissions are not enforced. Public details indicate the vulnerability affects OmniStudio before Spring 2025 a...

CVE-2025-27563 security_access_token has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission...

BIT-MOODLE-2024-33996 moodle: broken access control when setting calendar event type

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to...