CVE-2026-41657

Admidio is an open-source user management solution. Prior to version 5.0.9, the contactsdata.php endpoint uses a weaker permission check isAdministratorUsers, requiring only roledituser=true than the frontend UI contacts.php which correctly requires the stronger isAdministrator requiring...

CVE-2025-53919

The CVE concerns Portrait Dell Color Management (versions through 3.3.008). During installation/uninstallation, it creates a temporary folder with weak permissions, which a local, low-privileged attacker could abuse to elevate privileges. Affected product: Portrait Dell Color Management. Root cau...

CVE-2024-1343

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

Directory traversal

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2024-1343 Weak permission vulnerability in LaborOfficeFree

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2024-1343 Weak permission vulnerability in LaborOfficeFree

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2022-43701

When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code...

CVE-2023-33251

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

Previliage Escalation

ezsystems/ezpublish-kernel is vulnerable to privilege escalation. The vulnerability exists in evaluate function in ObjectStateLimitationType.php due to the weak permission which allows unauthorized user to elevate privileges...

Huawei EulerOS: Security Advisory for irssi (EulerOS-SA-2021-1306)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-9630

Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images...

CVE-2016-4984

/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it...

Tencent pigeon sdk application has a design logic vulnerability

Passenger Pigeon XG Push is a mobile App push platform that supports two mainstream platforms, Android and iOS. Tencent pigeon sdk application design logic vulnerabilities. Due to the Tencent pigeon sdk permission filtering is not strict, attackers can use the vulnerability can lead to override...

Macro Expert 4.0 - Multiple Privilege Escalations

Exploit for windows platform in category local exploits Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: email protected Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link:...

Macro Expert 4.0 - Multiple Privilege Escalations

Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link: http://www.macro-expert.com/download.htm Version: Software...

Cisco Unified IP phones 内存块设备弱权限漏洞

No description provided by source...

CVE-2014-9770

tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under 1 /run/log/journal/%m and 2 /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files...

librsync weak permission

Weak hash function is used...

IcedTea Web information leakage

Weak permission for temporary files...

ecshop后台弱权限sql注入一枚

简要描述： ecshop后台弱权限sql注入一枚 详细说明： PS:默认安装如果选择了安装测试数据就会多出2个帐号。本文再次从这两个帐号开始！ 漏洞发生在 admin/affiliateck.php 行29 if $REQUEST'act' == 'list' $logdb = getaffiliateck; .... 这里没有权限检查 然后移步到 方法getaffiliateck 224行有惊喜 if isset$GET'auid' $sqladd = ' AND a.userid=' . $GET'auid'; 未过滤的INT型注入。。。 就不多讲了 上代码...