1778 matches found
UBUNTU-CVE-2019-2001
The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-117422211...
Mambo CMS <= 4.6.5 Multiple Vulnerabilities
Mambo CMS is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation...
DuckDuckGo: XXE on https://duckduckgo.com
An XML External Entity XXE injection vulnerability was discovered in the x.js endpoint on https://duckduckgo.com via u parameter. This was due to improper sanitation of external XML entities. The results was a leak of certain world readable files on the system. This issue was patched. Additionall...
CVE-2019-0004 Juniper ATP: API and device keys are logged in a world-readable permissions file
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...
Information Disclosure
puppet-swift is vulnerable to information-disclosure. The vulnerability is possible as it has a flaw in the service deployment and leaves the proxy-server.conf file with world-readable permissions...
Sensitive Information Leakage
Red Hat Network RHN Configuration Client rhncfg-client tool is vulnerable to sensitive information leakage. It allows a local attacker to get rhncfg-client actions by reading the file since "/var/log/rhncfg-actions" file is set as world-readable...
Information Disclosure
JBoss SX and PicketBox is vulnerable to information disclosure. The audit.log file which stores logs containing confidential information is world-readable. This allows a local user to read the log file and obtain sensitive information such as usernames and passwords...
GHSA-99QR-9CC9-FV2X Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any...
Design/Logic Flaw
In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...
CVE-2018-13352
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...
CVE-2018-13352
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...
CVE-2018-1841
IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901...
Tmp files readable by other users in sync-exec
Affected versions of sync-exec use files located in /tmp/ to buffer command results before returning values. As /tmp/ is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via sync-exec under a higher privilege...
GHSA-38H8-X697-GH8Q Tmp files readable by other users in sync-exec
Affected versions of sync-exec use files located in /tmp/ to buffer command results before returning values. As /tmp/ is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via sync-exec under a higher privilege...
Input validation
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configuration files with world-readable permissions that could allow an authenticated malicious user to utilize the file contents to potentially...
Dell EMC ESRS Virtual Edition Incorrect File Permissions Vulnerability
Dell EMC ESRS is a secure storage product from DEll. An incorrect file permission vulnerability exists in Dell EMC ESRS Virtual Edition, an application that contains multiple configuration files with world-readable permissions, allowing an authenticated, malicious user to exploit the contents of...
CVE-2018-11752
Previous releases of the Puppet ciscoios module output SSH session debug information including login credentials to a world readable file on every run. These issues have been resolved in the 0.4.0 release...
CVE-2018-11752
Previous releases of the Puppet ciscoios module output SSH session debug information including login credentials to a world readable file on every run. These issues have been resolved in the 0.4.0 release...