CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow...

CVE-2025-27591

CVE-2025-27591 – Below privilege escalation : Prior to v0.9.0, the Below service creates a world-writable directory at /var/log/below and writes a world-writable log file, enabling local unprivileged users to perform a symlink attack (e.g., replacing error_root.log with a link to /etc/passwd). Th...

github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog

A flaw was found in glog, a logging library. This vulnerability allows an unprivileged attacker to overwrite sensitive files via a symbolic link planted in a widely writable directory, exploiting the log file path predictability...

CVE-2020-15264

The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looki...

AZL-56066 CVE-2024-45339 affecting package vitess for versions less than 19.0.4-4

When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that...

AZL-56379 CVE-2024-45339 affecting package glog 0.3.5-16

When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that...

PT-2025-3948 · G Data · G Data Security Client

Name of the Vulnerable Software and Affected Versions: G DATA Security Client versions are not explicitly specified in the provided descriptions. Description: The issue is related to incorrect assignment of privileges to directories in G DATA Security Client, allowing a local, unprivileged attack...

PT-2025-3947 · G Data · G Data Management Server

Name of the Vulnerable Software and Affected Versions: G DATA Management Server versions are not explicitly specified in the provided sources. Description: The issue is related to incorrect assignment of privileges of temporary files in the update mechanism, allowing a local, unprivileged attacke...

CVE-2024-47195

A vulnerability has been identified in ModelSim All versions V2024.3, Questa All versions V2024.3. gdb.exe in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and...

RHEL 5 : openhpi (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - openhpi: world writable /var/lib/openhpi directory CVE-2015-3248 Note that Nessus has not tested for this issue but...

PT-2024-5292 · Unknown · Openapi Generator

Name of the Vulnerable Software and Affected Versions: OpenAPI Generator versions prior to 7.6.0 Description: The issue is related to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to bypass security restrictions a...

PT-2024-22489 · Axigen · Axigen Mail Server

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server for Windows versions 10.5.18 and before Description: An issue was discovered in Axigen Mail Server for Windows, allowing local low-privileged attackers to execute arbitrary code and escalate privileges via insecure DLL...

Axigen 安全漏洞

Axigen is a mail server with groupware and collaboration features from Axigen, Inc. A security vulnerability exists in Axigen version 10.5.18 and earlier that originates from a vulnerability that allows a local, low-privilege attacker to execute arbitrary code and elevate privileges by loading an...

PT-2024-18166 · Bmc · Bmc Control-M

Name of the Vulnerable Software and Affected Versions: BMC Control-M versions 9.0.20 through 9.0.21 Description: The issue arises when BMC Control-M loads all Dynamic Link Libraries DLL from a directory that grants Write and Read permissions to all users upon user login. This can be leveraged to...

BIT-MINICONDA-2022-26526

Anaconda Anaconda3 Anaconda Distribution through 2021.11.0.0 and Miniconda3 through 4.11.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse fil...

Saltstack Minion Payload Deployer Exploit

This Metasploit exploit module uses saltstack salt to deploy a payload and run it on all targets which have been selected default all. Currently only works against nix targets. This module requires Metasploit: https://metasploit.com/download Current source:...

Saltstack Minion Payload Deployer

This exploit module uses saltstack salt to deploy a payload and run it on all targets which have been selected default all. Currently only works against nix targets. Module Options msf use exploit/linux/local/saltstacksaltminiondeployer msf exploitsaltstacksaltminiondeployer show targets...

CVE-2023-45252

DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges...

SUSE CVE-2023-4052

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction a form of symbolic link to allow...

UBUNTU-CVE-2023-4052

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction a form of symbolic link to allow...