CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

DEBIAN-CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

Design/Logic Flaw

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

UBUNTU-CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The CVE-2019-15608 issue is a TOCTOU race condition in Yarn where the package hash is computed before writing to the cache and not recomputed on read, enabling potential cache pollution. Connected sources confirm this affects Yarn versions older than 1.19.0 and that a fix exists in 1.19.0. Photon...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608: Time-of-check Time-of-use (TOCTOU) Race Condition

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

PT-2020-9730

Name of the Vulnerable Software and Affected Versions yarn versions prior to 1.19.0 Description The issue concerns a TOCTOU vulnerability in the package integrity validation. This vulnerability occurs because the hash is computed before writing a package to the cache, but it is not computed again...

SilverStripe Priviledge escalation through cache pollution

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

GHSA-6R58-4XGR-GM6M SilverStripe Priviledge escalation through cache pollution

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

Node.js third-party modules: [yarn] yarn.lock integrity & hash check logic is broken

I would like to report a vulnerability in yarn. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

Design/Logic Flaw

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

CVE-2019-12617

CVE-2019-12617 affects SilverStripe prior to or including version 4.3.3, with an access escalation vulnerability where CMS users with limited permissions can gain higher privileges due to a permission cache pollution issue. The connected records consistently describe “permission cache pollution” ...