Total
1756 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-0064 | 1 Sap | 1 Businessobjects Business Intelligence Platform | 2026-06-17 | N/A | 8.7 HIGH |
| Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability. | |||||
| CVE-2024-9842 | 2 Ivanti, Microsoft | 2 Secure Access Client, Windows | 2026-06-17 | N/A | 7.3 HIGH |
| Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. | |||||
| CVE-2024-9245 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-06-17 | N/A | 7.8 HIGH |
| Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-23966. | |||||
| CVE-2024-9244 | 1 Foxit | 2 Pdf Editor, Pdf Reader | 2026-06-17 | N/A | 7.8 HIGH |
| Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-23933. | |||||
| CVE-2024-9142 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye: before 2.0.642. | |||||
| CVE-2024-8900 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 7.5 HIGH |
| An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129, Firefox ESR < 128.3, and Thunderbird < 128.3. | |||||
| CVE-2024-8540 | 1 Ivanti | 1 Standalone Sentry | 2026-06-17 | N/A | 8.8 HIGH |
| Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components. | |||||
| CVE-2024-8256 | 2026-06-17 | N/A | N/A | ||
| In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API. | |||||
| CVE-2024-8039 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. | |||||
| CVE-2024-7986 | 1 Rockwellautomation | 1 Thinmanager | 2026-06-17 | N/A | 7.5 HIGH |
| A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junction that points to the target directory. | |||||
| CVE-2024-7612 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-06-17 | N/A | 8.8 HIGH |
| Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. | |||||
| CVE-2024-7594 | 2 Hashicorp, Openbao | 2 Vault, Openbao | 2026-06-17 | N/A | 7.5 HIGH |
| Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15. | |||||
| CVE-2024-7572 | 1 Ivanti | 1 Desktop \& Server Management | 2026-06-17 | N/A | 7.1 HIGH |
| Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. | |||||
| CVE-2024-7513 | 1 Rockwellautomation | 1 Factorytalk View | 2026-06-17 | N/A | 8.8 HIGH |
| CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions. | |||||
| CVE-2024-7245 | 1 Pandasecurity | 1 Panda Dome | 2026-06-17 | N/A | 7.8 HIGH |
| Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hydra Sdk Windows Service. The issue lies in the lack of proper permissions set on a folder created by the service. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23429. | |||||
| CVE-2024-6871 | 1 Gdata-software | 1 Total Security | 2026-06-17 | N/A | 7.8 HIGH |
| G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of autostart tasks. The issue results from incorrect permissions set on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22629. | |||||
| CVE-2024-6780 | 2026-06-17 | N/A | 3.3 LOW | ||
| Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. | |||||
| CVE-2024-6739 | 1 Openfind | 2 Mailaudit, Mailgates | 2026-06-17 | N/A | 5.3 MEDIUM |
| The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS. | |||||
| CVE-2024-6619 | 2026-06-17 | N/A | N/A | ||
| In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service. | |||||
| CVE-2024-6510 | 1 Avg | 1 Internet Security | 2026-06-17 | N/A | 7.8 HIGH |
| Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. | |||||