1144 matches found
CVE-2022-31087 Incorrect Default Permissions in ldap-account-manager
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php and .php5/.php4/.phpt/etc files. An attacker capable of writing...
PT-2022-3281 · Unknown · Ldap Account Manager
Name of the Vulnerable Software and Affected Versions: LDAP Account Manager versions prior to 8.0 Description: The issue allows an attacker to gain code execution on the host by writing a web-shell into the tmp directory, accessible via /lam/tmp/. This directory allows interpretation of .php file...
Fabric vulnerable to symlink attack on tmp files
Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on 1 a /tmp/fab..tar file or 2 certain other files in the top level of /tmp/...
GHSA-XWG2-QC6C-7C3Q Fabric vulnerable to symlink attack on tmp files
Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on 1 a /tmp/fab..tar file or 2 certain other files in the top level of /tmp/...
Virtualenv Allows Symlink Attack on /tmp/
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/...
GHSA-3JHC-WJQF-5F2C Virtualenv Allows Symlink Attack on /tmp/
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/...
SaltStack insecurely uses /tmp
Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...
GHSA-QR3X-V97P-42XW SaltStack insecurely uses /tmp
Unspecified vulnerability in salt-ssh in Salt aka SaltStack 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."...
Improper Control of Generation of Code in HawtJNI
Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp...
SaltStack has insecure /tmp file handling in salt/modules/chef.py
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...
GHSA-92PW-MFF9-JQGM Salt improper handling of tmp files
modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...
GHSA-8R7Q-CVJQ-X353 Incorrect Privilege Assignment in Jinja2
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with jinja2 in /tmp...
Ansible uses a socket with predictable filename in /tmp
runner/connectionplugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/...
GHSA-FJ24-GHP9-39V3 Ansible uses a socket with predictable filename in /tmp
runner/connectionplugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/...
sosreport sensitive information disclosure via weak permissions of the generated archives
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive...
GHSA-53WM-97P6-582F instack-undercloud vulnerable to symlink attack on tmp files
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploi...
Incorrect Default Permissions in Apache Commons FileUpload
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack...
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name
The diffpp function in lib/gauntletrubyparser.rb in the rubyparser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...
GHSA-8MVW-22R7-W6FQ ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name
The diffpp function in lib/gauntletrubyparser.rb in the rubyparser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...