Data::HashMap::Shared versions before 0.14 for Perl create a world-readable memory-mapped file without exclusive or no-follow flags, allowing local users to read IPC payloads and potentially exploit symlink or pre-creation race conditions in shared directories like /tmp or /dev/shm.
Data::RadixTree::Shared versions prior to 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication data and potentially exploit pre-creation or symlink redirection attacks. The vulnerability arises from the use of open() with mode 0666 and missing O_EXCL and O_NOFOLLOW flags.
Data::SortedSet::Shared versions before 0.03 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without secure flags O_EXCL or O_NOFOLLOW. This allows local users to read sensitive IPC payloads and potentially exploit race conditions or symlink attacks by pre-creating or redirecting the backing file in shared directories like /tmp or /dev/shm.
Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable memory-mapped backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing symlink following and pre-creation race conditions. This can lead to local users reading IPC payloads or redirecting the open to attacker-controlled files in shared directories like /tmp or /dev/shm.
Data::PubSub::Shared versions before 0.07 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially exploit pre-created files or symlinks to redirect file operations.
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
Data::Graph::Shared versions before 0.04 for Perl create a memory-mapped backing file with insecure permissions (world-readable) and open it without safeguards against symlink attacks or pre-existing files. This allows local users to read inter-process communication payloads and potentially exploit race conditions or file redirection in shared directories like /tmp or /dev/shm.
Data::Deque::Shared versions before 0.06 for Perl create a memory-mapped file with insecure permissions (world-readable) and open it without exclusive or no-follow flags. This allows local users to read IPC payloads and potentially exploit race conditions or symlink attacks in shared directories like /tmp or /dev/shm. The vulnerability is classified as CWE-732 (Incorrect Permission Assignment) and CWE-59 (Link Following).
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable memory-mapped file without using the O_NOFOLLOW flag. This allows local users to read IPC payloads stored in the shared segment and potentially redirect file operations via symlinks. The vulnerability arises from incorrect permission assignment and lack of symlink protection when creating the backing file in shared directories like /tmp or /dev/shm.
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_token, and another unprivileged user on a shared Linux or macOS host can read the token and obtain persistent access to the victim's Garmin Connect account, including health, fitness, activity, and device data. The Garmin.login tokenstore path is affected, and a pre-existing loosely permissioned token file remains exposed until rewritten or manually restricted. This issue is fixed in version 0.3.5.
Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control.
Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.
Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.
This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed.
This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.
CVE-2026-13769 is a medium severity vulnerability in AWS CLI versions prior to 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems. It involves overly permissive file permissions when the system's umask is not configured to restrict file permissions, potentially allowing other local users on the same host to read sensitive credentials generated by certain CLI subcommands. The issue is fixed in AWS CLI versions 1.44.78 and 2.34.29 or later.
Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.