CVE-2025-4043

An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot...

CVE-2025-4043 Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code

An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot...

CVE-2025-4043

CVE-2025-4043 affects Milesight UG65-868M-EA gateways (pre-60.0.0.46 firmware). An admin user can gain unauthorized write access to /etc/rc.local, which is executed at system boot, enabling persistence. Public documents describe risk as admin-command injection by a privileged user (CISA ICS advis...

Oracle Primavera Unifier Unauthorized Write (Apr 2025 CPU)

The versions of Primavera Unifier installed on the remote host are affected by an unauthorized write vulnerability as referenced in the April 2025 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Platform MPXJ. Supported versions tha...

CVE-2025-30293

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized write access...

CVE-2025-30290

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to bypass security...

Vulnerability fixed in Apple iOS, iPadOS, macOS Sequoia, visionOS and Safari

Apple has fixed a vulnerability in Apple iOS, iPadOS, macOS Sequoia, visionOS and Safari. The vulnerability with reference CVE-2025-24201 lies in the way Apple manages its operating systems. This includes an out-of-bounds write problem that can allow unauthorized actions. Apple has released updat...

CVE-2024-1654

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

GHSA-787V-V9VQ-4RGV Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

HPESBUX04729 rev.1 - HP-UX NTP Software, Denial of Service (DoS)

Potential Security Impact: Remote: Denial of Service DoS, Unauthorized Write Access to the File System, Null pointer dereference SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX NTP Software - Prior to C.4.2.8.7.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- |...

CVE-2024-49861

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map like in case of .rodata, it was still possible to write into it from a BPF program side through specific helpers having...

CVE-2024-31955

An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to successfully authenticate and write to the RPMB Replay Protected Memory Block area without possessing secret information...

CVE-2024-47659

In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1...

CVE-2024-42497

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams...

OpenJDK: Out-of-bounds access in 2D image handling (8324559)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1;...

CVE-2024-5815

CVE-2024-5815 is a Cross-Site Request Forgery in GitHub Enterprise Server that permits write operations on a victim-owned repository when an attacker who is a trusted GHE user induces the victim to visit a tag in the attacker’s fork. The issue affects all GitHub Enterprise Server versions prior t...

UBUNTU-CVE-2024-32978

Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity du...

CVE-2024-32978 Kaminari Insecure File Permissions Vulnerability

Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity du...