PT-2018-4063

Name of the Vulnerable Software and Affected Versions fedora-business-cards versions before 1-0.1.beta1.fc17 on Fedora 17 fedora-business-cards versions before 1-0.1.beta1.fc18 on Fedora 18 Description The issue allows local users to cause a denial of service or write to arbitrary files via a...

PT-2018-9941

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions 2.2.7 Description: The issue allows for a privilege escalation from an ordinary user to an admin user. This is achieved by manipulating the eff uid value within the $ COOKIE$this- loginkey to equal 1. The vulnerabilit...

CVE-2018-10519: Incorrect Permission Assignment for Critical Resource

CMS Made Simple CMSMS 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because o...

Linux/x86 - execve(cp /bin/sh /tmp/sh; chmod +s /tmp/sh) + Null-Free Shellcode (74 bytes)

Linux/x86 - execvecp /bin/sh /tmp/sh; chmod +s /tmp/sh + Null-Free Shellcode 74 bytes. Shellcode exploit for Linuxx86 platform / Title: Linux/x86 - cp /bin/sh /tmp/sh; chmod +s /tmp/sh Author: absolomb Website: https://www.sploitspren.com SLAE-ID: 1208 Purpose: cp shell into /tmp and setuid Teste...

Insecure path handling in Bundler

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could pla...

CVE-2017-0367

Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...

CVE-2017-0367

Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...

PT-2018-14440

Name of the Vulnerable Software and Affected Versions Xfce Thunar version 1.6.15 Description The issue arises when Xfce Thunar 1.6.15 is used with Xfce 4.12, specifically with the IBus-Unikey input method for file searches within the File Manager. This mishandling leads to an out-of-bounds read a...

CVE-2014-2312

The main function in androidmain.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid...

PT-2018-4199 · Intel +1 · Thermal +1

Name of the Vulnerable Software and Affected Versions: thermald affected versions not specified Description: The issue allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid, potentially leading to unauthorized data modification. This is due to a flaw in the main...

CVE-2018-5731

An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...

PT-2018-17116

Name of the Vulnerable Software and Affected Versions: Heimdal PRO version 2.2.190 Description: An issue in Heimdal PRO allows an attacker to exploit a vulnerability related to the scanning feature. The md.hs process writes an executable called CS1.tmp to C:windowsTEMP and then runs it. An attack...

PT-2018-6333

Name of the Vulnerable Software and Affected Versions: IBM Data Server Driver for JDBC and SQLJ versions 9.7 through 11.1 Description: The issue allows for object injection and potentially arbitrary code execution due to the deserialization of the contents of /tmp/connlicj.bin, depending on the...

CVE-2018-5731: Improper Input Validation

An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...

CVE-2017-1677: Deserialization of Untrusted Data

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

Race condition

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junksplitimage.ps in prog/splitimage2pdf.c...

Design/Logic Flaw

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

CVE-2018-7441

Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition, as demonstrated by /tmp/junksplitimage.ps in prog/splitimage2pdf.c...