CWE:

	Topic	Date	Author
Low	MobileTrans 4.0.11 Weak Service Permissions	20.05.2023	Thurein Soe
Med.	BarracudaDrive v6.5 Insecure Folder Permissions	04.09.2020	Bobby Cooke
Med.	BarracudaDrive 6.5 Local Privilege Escalation	11.08.2020	Bobby Cooke
Med.	Schneider Electric Wonderware InduSoft Web Studio 8.0 Patch 3 Insecure Permissions	02.07.2017	Karn Ganeshen
Med.	WIN-911 7.17.00 Insecure File Permissions / Plaintext Password Storage	07.09.2016	sh4d0wman
Med.	Hide.Me VPN Client 1.2.4 - Privilege Escalation	08.07.2016	sh4d0wman
Med.	PQI Air Pen Express CSRF / XSS / Insecure Direct Object Reference	06.04.2016	orwelllabs
High	Zarafa Multiple incorrect default permissions	25.08.2014	Robert Scheck
High	Eventum 2.3.4 Incorrect Permissions / Code Injection	29.01.2014	High-Tech Bridge Secur...
High	Zavio IP Cameras multiple vulnerabilities	28.05.2013	CORE
Med.	Photodex ProShow Producer 5.0.3310 Privilege Escalation	20.03.2013	Inshell Security Advis...

---

CVEMAP Search Results

CVE

Details

Description

2024-04-24

CVE-2023-23976

Updating...

Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.

2024-03-26

CVE-2024-25958

Updating...

Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to privilege escalation, unauthorized access to application data, unauthorized modification of application data and service disruption.

2024-03-01

CVE-2024-26280

Updating...

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

2024-02-27

CVE-2023-48678

Updating...

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391.

2024-02-13

CVE-2023-50236

Updating...

A vulnerability has been identified in Polarion ALM (All versions). The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privileges to NT AUTHORITY\SYSTEM.

2024-02-09

CVE-2024-24828

Updating...

pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix systems, this is `/tmp/pkg/*` which is a shared directory for all users on the same local system. There is no uniqueness to the package names within this directory, they are predictable. An attacker who has access to the same local system has the ability to replace the genuine executables in the shared directory with malicious executables of the same name. A user may then run the malicious executable without realising it has been modified. This package is deprecated. Therefore, there will not be a patch provided for this vulnerability. To check if your executable build by pkg depends on native code and is vulnerable, run the executable and check if `/tmp/pkg/` was created. Users should transition to actively maintained alternatives. We would recommend investigating Node.js 21�??s support for single executable applications. Given the decision to deprecate the pkg package, there are no official workarounds or remediations provided by our team. Users should prioritize migrating to other packages that offer similar functionality with enhanced security.

2024-01-21

CVE-2024-0770

Updating...

A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2024-01-16

CVE-2024-22409

Updating...

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.

2023-12-09

CVE-2023-28870

Updating...

Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.

2023-12-06

CVE-2023-46773

Updating...

Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.

 

---

Copyright 2024, cxsecurity.com