CWE-732: Incorrect Permissions vulnerabilities

Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.

CVE-2024-2905 is a security vulnerability in rpm-ostree where the /etc/shadow file in default builds has the world-readable bit enabled. This incorrect permission setting could expose sensitive authentication data to unauthorized users. The vulnerability affects rpm-ostree version 1.2024.4. A fix has been issued by Red Hat and is available as part of updates for Red Hat Enterprise Linux 10.

A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system.

CVE-2023-4332 is a vulnerability in Broadcom's LSI Storage Authority (LSA) RAID Controller web interface caused by incorrect permission assignment on a critical log file. This improper permission setting could potentially allow unauthorized access to sensitive log data. No CVSS score is provided, and no known exploits are reported in the wild. The affected version is explicitly stated as version 0. No patch or remediation information is available at this time.

CVE-2023-31238 is a medium-severity vulnerability affecting multiple versions of Siemens SICAM P850 and related products prior to version 3.11. The issue stems from incorrect permission assignment related to cookie protection flags, allowing attackers who obtain a session token to impersonate legitimate users. Exploitation requires network access with low privileges and user interaction, and the vulnerability impacts confidentiality, integrity, and availability to a limited extent. No known exploits are currently reported in the wild. European organizations using SICAM P850 devices, especially in critical infrastructure sectors like energy and utilities, are at risk. Mitigation involves upgrading to version 3.11 or later and implementing strict session management and network segmentation. Countries with significant Siemens industrial control system deployments, such as Germany, France, and the UK, are most likely affected.

EPSS 0.4%VulnerabilityCWE-732Germany+2

A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.