Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop directory. The installer creates this directory without proper ownership verification, creating two exploitation scenarios:
Scenario 1 (Persistent Attack):
If a low-privileged attacker pre-creates C:\ProgramData\DockerDesktop before Docker Desktop installation, the attacker retains ownership of the directory even after the installer applies restrictive ACLs. At any time after installation completes, the attacker can modify the directory ACL (as the owner) and tamper with critical configuration files such as install-settings.json to specify a malicious credentialHelper, causing arbitrary code execution when any user runs Docker Desktop.
Scenario 2 (TOCTOU Attack):
During installation, there is a time-of-check-time-of-use (TOCTOU) race condition between when the installer creates C:\ProgramData\DockerDesktop and when it sets secure ACLs. A low-privileged attacker actively monitoring for the installation can inject malicious files (such as install-settings.json) with attacker-controlled ACLs during this window, achieving the same code execution outcome.
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0.
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system.
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains an incorrect permission assignment for critical resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.
CVE-2025-59961 is a medium-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the DHCP daemon (jdhcpd). It allows a local, low-privileged user to write to the Unix socket managing the DHCP service, enabling administrative control over the DHCP server or relay. This flaw arises from incorrect permission assignments on a critical resource, permitting unauthorized command execution without user interaction. The vulnerability impacts multiple Junos OS versions prior to various patch releases starting from 21.2R3-S10 and corresponding Junos OS Evolved versions. Exploitation requires local access but no elevated privileges or user interaction. Although no known exploits are reported in the wild, the ability to control DHCP services can disrupt network operations and potentially facilitate further attacks. European organizations using affected Juniper devices should prioritize patching to mitigate risks.
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port forwarding to access the Docker socket. By mounting the host filesystem via Docker, an attacker can escape the container and execute arbitrary OS commands as root on the underlying vRIoT controller, resulting in complete system compromise.
AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.
VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security for PC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27147.
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an application file that is writable by a lower‑privileged user. A local attacker with access to the application account can modify this file to introduce malicious code, which is then executed with elevated privileges when the script is run. Successful exploitation results in arbitrary code execution as the root user.
CVE-2025-13733 is a high-severity local privilege escalation vulnerability in BuhoNTFS version 1.3.2 caused by incorrect permission assignment in an XPC service. It allows unprivileged local users to escalate privileges to root without user interaction or authentication. The vulnerability stems from insecure functions within the XPC service that expose critical resources with improper permissions. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to systems running the affected version. European organizations using BuhoNTFS 1.3.2, especially those in sectors with sensitive data or critical infrastructure, could face severe confidentiality, integrity, and availability impacts if exploited. Mitigation requires immediate patching once available, restricting local user access, and auditing permission settings on XPC services.
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
CVE-2025-62575 is a high-severity vulnerability in Mirion Medical's EC2 Software NMIS BioDose, affecting versions up to V22.02. The issue arises because the SQL Server user account 'nmdbuser' and other created accounts are assigned the sysadmin role by default, granting excessive privileges. This misconfiguration allows remote attackers to execute arbitrary code via certain built-in stored procedures without requiring user interaction or high authentication levels. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant risk to confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and critical access level make it a pressing concern. European healthcare and medical research organizations using this software are particularly at risk due to the sensitive nature of the data and regulatory requirements. Mitigation requires immediate privilege reduction for SQL accounts, strict access controls, and monitoring of database activities.
NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.
CVE-2025-64642 is a high-severity vulnerability in Mirion Medical's EC2 Software NMIS BioDose (version 22.02 and earlier) where installation directories have insecure file permissions. This misconfiguration allows local users on client workstations to modify critical program executables and libraries without requiring authentication or user interaction. Exploiting this vulnerability could lead to privilege escalation, code tampering, or disruption of medical dose measurement operations. Although no known exploits are reported in the wild yet, the vulnerability poses a significant risk to the integrity and availability of the affected software. European healthcare organizations using this software are particularly at risk due to the critical nature of medical radiation dose monitoring. Mitigation requires immediate review and correction of file permissions on installation directories, restricting write access to trusted administrators only. Countries with advanced healthcare infrastructure and known deployments of Mirion Medical products, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the ease of local exploitation and high impact on system integrity and availability, this vulnerability is rated as high severity. Defenders should prioritize patching or applying configuration hardening to prevent unauthorized modifications.
