EulerOS Virtualization 2.9.0 : edk2 (EulerOS-SA-2021-1668)

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - EFI Development Kit II AARCH64 UEFI FirmwareSecurity Fixes:AuthenticodeVerify calls OpenSSLs d2iPKCS7 API to parse asn encoded signe...

CVE-2020-14418

CVE-2020-14418 refers to a TOCTOU vulnerability in the library/middleware product madCodeHook before 2020-07-16, enabling local attackers to escalate to SYSTEM via path redirection (directory junctions). The issue is a local privilege escalation with an impact on confidentiality, integrity, and a...

Windows Exploitation Tricks: Trapping Virtual Memory Access

Posted by James Forshaw, Project Zero This blog is a continuation of my series of Windows exploitation tricks. This one describes an exploitation trick I’ve been trying to develop for years, succeeding mostly, more on that later on the latest versions of Windows 10. It’s a trick to trap access to...

Bitdefender Hypervisor Introspection Input Validation Error Vulnerability

Bitdefender Hypervisor Introspection is a Hypervisor Introspection HVI security solution from Bitdefender Romania. It protects business-sensitive data before it is exposed by detecting and blocking cyberattacks in real-time. Bitdefender Hypervisor Introspection suffers from an input validation...

FreeBSD : FreeBSD -- sendmsg(2) privilege escalation (8db74c04-d794-11ea-88f8-901b0ef719ab)

When handling a 32-bit sendmsg2 call, the compat32 subsystem copies the control message to be transmitted if any into kernel memory, and adjusts alignment of control message headers. The code which performs this work contained a time-of-check to time-of-use TOCTOU vulnerability which allows a...

nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

Open-Xchange: SSRF protection bypass in /appsuite/api/oxodocumentfilter addfile action

Summary The URL validation logic applied when handling /appsuite/api/oxodocumentfilter&action=addfile suffers from three defects which can be used to execute Time of Check Time of Use ToCToU SSRF attack. This issue allows malicious actors to execute HTTP GET requests on internal network services...

CVE-2020-3808

Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use toctou race condition vulnerability. Successful exploitation could lead to arbitrary file deletion...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

DEBIAN-CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-20000

The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link attack, allowing privileged files to be deleted...

CVE-2012-5630

libuser 0.56 and 0.57 has a TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

CVE-2019-18644

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted...

Medium: docker

Issue Overview: A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause...

CVE-2018-15664

A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause arbitrary files on t...

Code injection

VMware ESXi 6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001, Workstation 15.x before 15.0.4, 14.x before 14.1.7, Fusion 11.x before 11.0.3, 10.x before 10.1.6 contain a Time-of-check Time-of-use TOCTOU vulnerability in the virtual USB 1.1 UHCI Universal Ho...

CVE-2018-0952

An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka “Diagnostic Hub Standard Collector Elevation Of Privilege Vulnerability.” This affects Windows Server 2016, Windows 10, Microsoft Visual Studio, Windows 10...