Threats Tagged 'cwe-276'

CVE-2025-2782 is a medium severity vulnerability in WatchGuard SSO Terminal Services Agent version 12.0. It involves improper directory permission configuration when the agent is installed in a non-default directory, potentially allowing an authenticated local attacker to escalate privileges to SYSTEM on the affected Windows system.

CVE-2025-2781 is a vulnerability in WatchGuard Mobile VPN with SSL Client for Windows where improper directory permissions are set when installed in a non-default directory. This misconfiguration can allow an authenticated local attacker to escalate privileges to SYSTEM on the affected system. The vulnerability is rated medium severity with a CVSS score of 6.3.

Red Hat has released OpenShift Virtualization 4.14.16 images as a product enhancement advisory. This update includes bug fixes and enhancements but does not list any specific fixes for CVE-2025-57848 or other vulnerabilities. The advisory does not provide details on the nature of CVE-2025-57848 beyond its association with CWE-276 (Incorrect Default Permissions). No active exploits are known in the wild. No affected versions are explicitly stated in the advisory.

NoteGen versions prior to 0.32.0 include a vulnerability where the Tauri shell plugin grants shell:allow-execute capability for bash, python, and python3 with arbitrary arguments by default. This allows JavaScript running in the application's webview to execute operating system commands with the privileges of the NoteGen process. If an attacker can execute scripts in the webview (e.g., via cross-site scripting), they can achieve full remote code execution on the user's machine.

In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11.

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus. This issue is fixed in version 2.1.3.

Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464