CWE-379

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T12:37:10.464869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T12:41:00.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "servereye Windows Agent (Sensorhub)",
          "vendor": "servereye GmbH",
          "versions": [
            {
              "lessThanOrEqual": "20.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "20.16",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Janik Wehrli of InfoGuard Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\\ServerEye3\\update\\ for a trigger file named \"update_available\". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently\u0026nbsp;executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges.\u003c/p\u003e"
            }
          ],
          "value": "The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\\ServerEye3\\update\\ for a trigger file named \"update_available\". Due to insufficient access restrictions on this directory, a local standard user can create the trigger file and provide a path to a directory containing malicious JSON instructions. The service subsequently\u00a0executes the utility UpdaterAction.exe with SYSTEM privileges, which parses the instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination (e.g., overwriting a service binary). This leads to full system compromise as the service automatically restarts the overwritten binary with SYSTEM privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T09:42:34.205Z",
        "orgId": "455daabc-a392-441d-aa46-37d35189897c",
        "shortName": "NCSC.ch"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.servereye.de/security-bulletins/2026-001/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Local Privilege Escalation in servereye client (sensorhub)",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
    "assignerShortName": "NCSC.ch",
    "cveId": "CVE-2026-14551",
    "datePublished": "2026-07-22T09:42:34.205Z",
    "dateReserved": "2026-07-03T08:49:30.333Z",
    "dateUpdated": "2026-07-22T12:41:00.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12555",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T03:56:48.303782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T16:24:51.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "HP Easy Start for macOS",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "2.16.7.260722",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities."
            }
          ],
          "value": "Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of temporary file in directory with insecure permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:13:15.889Z",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HP Easy Start for macOS - Security Update",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2026-12555",
    "datePublished": "2026-08-24T16:00:23.156Z",
    "dateReserved": "2026-06-17T19:59:49.335Z",
    "dateUpdated": "2026-09-03T15:13:15.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:52.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HP Dock Accessory",
          "vendor": "HP Inc.",
          "versions": [
            {
              "lessThan": "\u003c1.4.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability."
            }
          ],
          "value": "A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of temporary file in directory with insecure permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T19:47:15.371Z",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "url": "https://support.hp.com/us-en/document/ish_15190804-15190818-16/hpsbhf04129"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HP Dock Accessory WMI Provider Installer Security Update",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2026-7539",
    "datePublished": "2026-06-24T19:47:15.371Z",
    "dateReserved": "2026-04-30T18:32:09.603Z",
    "dateUpdated": "2026-06-26T03:55:52.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T20:31:34.178282Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T20:31:49.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "org.springframework.data:spring-data-geode",
          "product": "Spring Data Geode",
          "repo": "https://github.com/spring-attic/spring-data-geode",
          "vendor": "VMware",
          "versions": [
            {
              "lessThanOrEqual": "2.7.18",
              "status": "affected",
              "version": "2.0.0.RELEASE",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "org.springframework.data:spring-data-gemfire",
          "product": "Spring Data Gemfire",
          "repo": "https://github.com/spring-attic/spring-data-gemfire",
          "vendor": "VMware",
          "versions": [
            {
              "lessThanOrEqual": "2.2.13.RELEASE",
              "status": "affected",
              "version": "1.7.0.RELEASE",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user\u2019s extracted snapshot\u0026nbsp;contents, leading to unintended exposure of cache data."
            }
          ],
          "value": "Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user\u2019s extracted snapshot\u00a0contents, leading to unintended exposure of cache data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-149",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-149 Explore for Predictable Temporary File Names"
            }
          ]
        },
        {
          "capecId": "CAPEC-155",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-155 Screen Temporary Files for Sensitive Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-538",
              "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-378",
              "description": "CWE-378: Creation of Temporary File With Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379: Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T17:18:09.839Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "url": "https://www.herodevs.com/vulnerability-directory/cve-2026-2817"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "unsupported-when-assigned",
        "x_open-source"
      ],
      "title": "Spring Data Geode Insecure Temporary Directory Usage",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2026-2817",
    "datePublished": "2026-02-19T17:18:09.839Z",
    "dateReserved": "2026-02-19T17:07:39.475Z",
    "dateUpdated": "2026-02-20T20:31:49.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Hp Easy Start",
          "vendor": "Hp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1104",
              "description": "CWE-1104",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-319",
              "description": "CWE-319",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-379",
              "description": "CWE-379",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:57:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/30"
        },
        {
          "url": "https://ciphersecuritylabs.com"
        },
        {
          "url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-12554",
              "type": "related"
            },
            {
              "destId": "CVE-2026-12555",
              "type": "related"
            },
            {
              "destId": "CVE-2026-12556",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0184",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
            "automated": true,
            "contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-02T20:13:24Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0184"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-11T11:57:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0184"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Hp Easy Start",
          "vendor": "Hp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1104",
              "description": "CWE-1104",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-319",
              "description": "CWE-319",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-379",
              "description": "CWE-379",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:57:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/30"
        },
        {
          "url": "https://ciphersecuritylabs.com"
        },
        {
          "url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/30"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0001",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
            "automated": true,
            "contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-02T20:13:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:41:22Z",
    "dateUpdated": "2026-09-11T11:57:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0001"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71176",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T12:26:25.446376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T12:26:39.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageURL": "pkg:pypi/pytest",
          "product": "pytest",
          "vendor": "pytest",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-22T06:50:44.054Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/pytest-dev/pytest/issues/13669"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/21/5"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-71176",
    "datePublished": "2026-01-22T04:59:17.273Z",
    "dateReserved": "2026-01-22T04:59:16.985Z",
    "dateUpdated": "2026-01-22T12:26:39.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64896",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T20:56:37.238237Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-09T20:56:43.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Creative Cloud Desktop",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "6.4.0.361",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-12-09T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to disrupt the application\u0027s functionality by manipulating temporary files. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-09T20:39:50.648Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/creative-cloud/apsb25-120.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Creative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2025-64896",
    "datePublished": "2025-12-09T20:39:50.648Z",
    "dateReserved": "2025-11-11T22:48:38.847Z",
    "dateUpdated": "2025-12-09T20:56:43.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-33111",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T15:25:17.501554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-09T16:05:55.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*"
          ],
          "product": "Controller",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.1.1",
              "status": "affected",
              "version": "11.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_controller:11.0.1:FP6:*:*:*:*:*:*"
          ],
          "product": "Cognos Controller",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.0.1 FP6",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.\u003c/p\u003e"
            }
          ],
          "value": "IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T21:28:37.212Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7253273"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRemediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Controller 11.1.0 - 11.1.1 Download IBM Controller 11.1.2 from Passport Advantage IBM Cognos Controller 11.0.0 - 11.0.1 FP6 Download IBM Cognos Controller 11.0.1 FP7 from Fix Central IBM Controller 11.1.2 and IBM Cognos Controller 11.0.1 FP7 are available for Cloud deployments.\u003c/p\u003e"
            }
          ],
          "value": "Remediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Controller 11.1.0 - 11.1.1 Download IBM Controller 11.1.2 from Passport Advantage IBM Cognos Controller 11.0.0 - 11.0.1 FP6 Download IBM Cognos Controller 11.0.1 FP7 from Fix Central IBM Controller 11.1.2 and IBM Cognos Controller 11.0.1 FP7 are available for Cloud deployments."
        }
      ],
      "title": "IBM Controller Information Disclosure",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-33111",
    "datePublished": "2025-12-08T21:28:37.212Z",
    "dateReserved": "2025-04-15T17:50:49.744Z",
    "dateUpdated": "2025-12-09T16:05:55.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-28T17:23:10.150529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-28T17:23:22.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kea",
          "vendor": "ISC",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.2",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.7.8",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ISC would like to thank Matthias Gerstner from the SUSE security team for bringing this vulnerability to our attention."
        }
      ],
      "datePublic": "2025-05-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea.  Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.\nThis issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "We are not aware of any active exploits."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "If an attacker has access to a local unprivileged user account, and the Kea API entry points are not secured, the attacker can use the API to arbitrarily modify Kea\u0027s configuration or to overwrite any file Kea has write access to.  If Kea is running as root, the attacker could overwrite any local file.  This can lead to local privilege escalation and/or system-wide denial of service.  If control sockets are placed in an insecure location, any local user may be able to impersonate a Kea service or prevent the real Kea service from starting."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-28T17:08:11.180Z",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "name": "CVE-2025-32802",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://kb.isc.org/docs/cve-2025-32802"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to the patched release most closely related to your current version of Kea: 2.4.2, 2.6.3, or 2.7.9."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Insecure handling of file paths allows multiple local attacks",
      "workarounds": [
        {
          "lang": "en",
          "value": "Two mitigation approaches are possible: (1) Disable the API entirely, by (1a) disabling the `kea-ctrl-agent`, and (1b) removing any `\"control-socket\"` stanzas from the Kea configuration files; or (2) Secure access to the API by (2a) requiring authentication (a password or client certificate) for the `kea-ctrl-agent`, and (2b) configuring all `\"control-socket\"` stanzas to use a directory restricted to only trusted users."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2025-32802",
    "datePublished": "2025-05-28T17:08:11.180Z",
    "dateReserved": "2025-04-10T12:51:45.055Z",
    "dateUpdated": "2025-05-28T17:23:22.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}