Token Leakage

Tina CMS is vulnerable to search Token leakage. The vulnerability is due to the search token being leaked through the lock file tina-lock.json, allows an attacker to gain unauthorized access to the search functionality by exploiting the leaked search token...

TinaCMS 安全漏洞

TinaCMS is an open source headless CMS for Markdown, MDX and JSON. A security vulnerability exists in TinaCMS versions prior to 1.6.2, which stems from a search token that may be leaked via a lock file...

PT-2024-31595 · Unknown · @Tinacms/Cli

Name of the Vulnerable Software and Affected Versions: @tinacms/cli versions prior to 1.6.2 Description: Tina is an open-source content management system CMS. Sites building with Tina CMS's command line interface CLI that use a search token may be vulnerable to the search token being leaked via...

CVE-2024-41012

In the Linux kernel, CVE-2024-41012 pertains to a fcntl/close race in file locking where an LSM could allow the first do_lock_file_wait() to acquire a lock while denying the second removal, and POSIX lock removal could fail due to GFP_KERNEL allocation during range splitting. The issue can lead t...

RHEL 4 : xorg-x11 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - x11perfcomp has dot in its path CVE-2011-2504 - The LockServer function in os/utils.c in X.Org xserver...

GHSA-J4G3-3Q8X-JXQP dbt-core's secret env vars written to package-lock.json in plaintext

Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...

PT-2023-33033 · Dbt-Core · Dbt-Core

Name of the Vulnerable Software and Affected Versions: dbt-core versions prior to 1.7.3 Description: The issue arises when dbt-core is used to pull source code from a private repository using a Personal Access Token PAT. In this scenario, some versions of dbt-core write a URL with the PAT in...

SMPN 1 Semarang absis security vulnerability

absis is an open source web-based K13/KTSP academic system from SMPN 1 Semarang. A security vulnerability exists in SMPN 1 Semarang absis v.2017-10-19 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the user parameter of the lock/lock.php file...

Tongda OA 2017 Security Breach

Tongda2000 is a network intelligent office system from China Tongda Tongda. A security vulnerability exists in Tongda OA 2017 11.9 and earlier versions, which originates from a SQL injection vulnerability in the parameter TERMIDSTR in the file general/wiki/cp/manage/lock.php...

DEBIAN-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

UBUNTU-CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

pdm security breach

pdm is a Python package management tool for the PDM project. A security vulnerability exists in versions of pdm prior to 0.11.2, which stems from the ability to craft a malicious pdm.lock file that allows an insider or malicious open source project to appear to rely on a trusted PyPI project, but...

PT-2023-29697

Name of the Vulnerable Software and Affected Versions pdm versions prior to 2.9.4 Description It's possible to craft a malicious pdm.lock file that could allow an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A...

PT-2023-24670 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.18 Description: The issue arises from an incorrect configuration in the .htaccess file, allowing the configuration file of Javascript dependencies to be read in production environments, specifically the...

SUSE CVE-2007-0472

Multiple race conditions in Smb4K before 0.8.0 allow local users to 1 modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the removelockfile function in core/smb4kfileio.cpp, and 2 add lines to the sudoers file via a symlink attack on...

SUSE CVE-2008-5256

The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary file...

SUSE CVE-2010-0791

The 1 ncpmount, 2 ncpumount, and 3 ncplogin programs in ncpfs 2.2.6 do not properly create lock files, which allows local users to cause a denial of service application failure via unspecified vectors that trigger the creation of a /etc/mtab file that persists after the program exits...

SUSE CVE-2011-1677

mount in util-linux 2.19 and earlier does not remove the /etc/mtab lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors...

SUSE CVE-2011-1680

ncpmount in ncpfs 2.2.6 and earlier does not remove the /etc/mtab lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors...

SUSE CVE-2011-4029

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service removed execution permission via a symlink attack on a temporary lock file...