CVE-2022-21704: Incorrect Default Permissions

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable in unix. This could cause problems if log files contain sensitive information. This would affect any users that have not...

CVE-2022-21704

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable in unix. This could cause problems if log files contain sensitive information. This would affect any users that have not...

IBM Sterling Gentran 日志信息泄露漏洞

IBM Sterling Gentran is a versatile, high-performance solution from IBM USA designed to help exchange EDI and other types of data. A log information disclosure vulnerability exists in IBM Sterling Gentran that stems from storing potentially sensitive information in log files that can be read by...

PT-2022-12304

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.1 Description An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest of...

coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...

Mozilla Firefox Security Advisory (MFSA2012-09) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

coreos-installer < 0.10.0 writes world-readable Ignition config to installed system

Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config. Default configurations of Fedora CoreOS and RHEL...

PT-2021-22427 · Unknown · Coreos-Installer

Name of the Vulnerable Software and Affected Versions: coreos-installer versions prior to 0.10.0 Description: A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read...

CVE-2021-43413

An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access...

CVE-2021-3917

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...

Security update for wireguard-tools (moderate)

openSUSE Security Update: Security update for wireguard-tools Announcement ID: openSUSE-SU-2021:1425-1 Rating: moderate References: 1191224 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for wireguard-tools fixes the...

PT-2021-27360

Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

openSUSE: Security Advisory for wireguard-tools (openSUSE-SU-2021:3527-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2021:3527-1 Security update for wireguard-tools

This update for wireguard-tools fixes the following issues: - Removed world-readable permissions from /etc/wireguard bsc1191224...

PT-2021-27372

Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard that have been removed. Recommendations: At the moment, there is no information about a newer version that contains...

PT-2021-28452

Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard that have been removed. Recommendations: At the moment, there is no information about a newer version that contains...

coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...

CVE-2020-4805

IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539...

RHEL 8 : cloud-init (RHSA-2021:3371)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3371 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

cloud-init: randomly generated passwords logged in clear-text to world-readable file

A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The...