Export limit exceeded: 29759 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Search Results (1794 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-22849 1 Intel 1 Optane Pmem Management Software 2026-02-11 6.7 Medium
Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2025-15339 1 Tanium 2 Discover, Service Discover 2026-02-10 6.5 Medium
Tanium addressed an incorrect default permissions vulnerability in Discover.
CVE-2025-15341 1 Tanium 2 Benchmark, Service Benchmark 2026-02-10 6.5 Medium
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
CVE-2025-15335 1 Tanium 2 Service Threatresponse, Threat Response 2026-02-10 4.3 Medium
Tanium addressed an information disclosure vulnerability in Threat Response.
CVE-2025-15334 1 Tanium 2 Service Threatresponse, Threat Response 2026-02-10 4.3 Medium
Tanium addressed an information disclosure vulnerability in Threat Response.
CVE-2025-15340 1 Tanium 2 Comply, Service Comply 2026-02-10 6.5 Medium
Tanium addressed an incorrect default permissions vulnerability in Comply.
CVE-2025-15338 1 Tanium 2 Partner Integration, Service Partnerintegration 2026-02-10 6.5 Medium
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
CVE-2025-10314 1 Mitsubishi Electric 1 Freqship-mini 2026-02-05 8.8 High
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.
CVE-2025-55132 1 Nodejs 2 Node.js, Nodejs 2026-02-03 5.3 Medium
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-20984 1 Samsung 11 Galaxy Watch, Galaxy Watch 4, Galaxy Watch 4 Classic and 8 more 2026-02-02 6.8 Medium
Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galaxy Watch.
CVE-2025-67230 1 Todesktop 1 Builder 2026-01-29 7.1 High
Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.
CVE-2026-0705 1 Acronis 1 Cloud Manager 2026-01-29 N/A
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.4.25342.354.
CVE-2025-66518 1 Apache 1 Kyuubi 2026-01-27 8.8 High
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.
CVE-2025-39201 1 Hitachienergy 1 Microscada X Sys600 2026-01-26 6.1 Medium
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service.
CVE-2026-23634 1 Defenseunicorns 1 Pepr 2026-01-26 0 Low
Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.
CVE-2021-47852 1 Rockstargames 1 Launcher 2026-01-26 8.8 High
Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak permissions. Attackers can replace the RockstarService.exe with a malicious binary to create a new administrator user and gain elevated system access.
CVE-2025-15523 2 Apple, Inkscape 2 Macos, Inkscape 2026-01-26 4.4 Medium
MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising attacker's malicious intent. This issue has been fixed in 1.4.3 version of Inkscape.
CVE-2025-5255 2026-01-21 N/A
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da
CVE-2025-45467 1 Unitree 2 Go1, Go1 Firmware 2026-01-12 7.1 High
Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.
CVE-2024-7587 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2026-01-09 7.8 High
Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64, ICONICS Suite, MC Works64, or GENESIS32.