Filtered by CWE-276
Total 1410 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-24172 1 Apple 1 Macos 2025-11-03 9.8 Critical
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. "Block All Remote Content" may not apply for all mail previews.
CVE-2025-24170 1 Apple 1 Macos 2025-11-03 7.8 High
A logic issue was addressed with improved file handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
CVE-2025-24140 1 Apple 1 Macos 2025-11-03 5.3 Medium
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. Files downloaded from the internet may not have the quarantine flag applied.
CVE-2025-24135 1 Apple 1 Macos 2025-11-03 7.8 High
This issue was addressed with improved message validation. This issue is fixed in macOS Sequoia 15.3. An app may be able to gain elevated privileges.
CVE-2025-24107 1 Apple 5 Ipados, Iphone Os, Macos and 2 more 2025-11-03 7.8 High
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3, iOS 18.3 and iPadOS 18.3. A malicious app may be able to gain root privileges.
CVE-2025-24093 1 Apple 1 Macos 2025-11-03 9.8 Critical
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3. An app may be able to access removable volumes without user consent.
CVE-2025-8031 2 Mozilla, Redhat 4 Firefox, Firefox Esr, Thunderbird and 1 more 2025-11-03 9.8 Critical
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-52361 1 Ak-nord 1 Usb-server-lxl 2025-11-03 7.8 High
Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction and on every system boot.
CVE-2025-27682 1 Printerlogic 2 Vasion Print, Virtual Appliance 2025-11-03 9.8 Critical
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
CVE-2025-27677 1 Printerlogic 2 Vasion Print, Virtual Appliance 2025-11-03 9.8 Critical
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
CVE-2025-62577 5 Fsas Technologies, Linux, Microsoft and 2 more 5 Eternus Sf, Linux, Windows Server and 2 more 2025-11-03 N/A
ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management server may obtain database credentials, potentially allowing execution of OS commands with administrator privileges.
CVE-2022-22948 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-10-31 6.5 Medium
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
CVE-2025-8432 1 Centreon 1 Centreon 2025-10-30 8.4 High
Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.
CVE-2024-42188 1 Hcltech 1 Connections 2025-10-28 3.7 Low
HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
CVE-2025-46185 1 Pgcodekeeper 1 Pgcodekeeper 2025-10-27 6.2 Medium
An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames.
CVE-2025-61035 1 Seffaflik 1 Seffaflik 2025-10-27 7.7 High
The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file, which is created with mode 0777 and 0775 respectively, exposing secrets to other local users. Additionally, the .kimlik file is written without symlink checks, allowing local attackers to overwrite arbitrary files. This can result in information disclosure and denial of service.
CVE-2025-11575 2 Microsoft, Mongodb 2 Windows, Mongodb 2025-10-27 7.8 High
Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.
CVE-2025-23347 1 Nvidia 6 Geforce, Nvs, Project G Assist and 3 more 2025-10-27 7.8 High
NVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVE-2025-12100 1 Mongodb 2 Connector For Bi, Mongodb 2025-10-27 7.8 High
Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.
CVE-2025-57848 1 Redhat 1 Container Native Virtualization 2025-10-27 5.2 Medium
A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.