241 matches found
CVE-2025-67124
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization when uploads are enabled can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination...
GHSA-MXC8-4JQF-368Q miniserve affected by a TOCTOU and symlink race vulnerability
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization when uploads are enabled can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination...
MiracleLinux 9 : pki-servlet-engine-9.0.50-1.el9_2.2 (AXSA:2025-10718:01)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10718:01 advisory. tomcat: RCE due to TOCTOU issue in JSP compilation CVE-2024-50379 Tenable has extracted the preceding description block directly from the MiracleLinux...
CVE-2026-22701 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition betwee...
SUSE SLED15 / SLES15 Security Update : python-filelock (SUSE-SU-2026:0082-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0082-1 advisory. - CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files bsc125524...
CVE-2019-18644
The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted...
CVE-2022-31466
Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...
Linux Distros Unpatched Vulnerability : CVE-2025-40331
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctpdiagdump - sctpforeachendpoint - sctpepdump make sure not to exce...
CLSA-2025-1764580671 pki-servlet-engine: Fix of 2 CVEs
CVE-2024-50379: fix TOCTOU vulnerability in JSP compilation to prevent RCE on case insensitive file systems - CVE-2024-38286: fix issue of resource allocation without limits or throttling vulnerability in TLS handshake process - Apply skip-common-daemon patch to remove the commons-daemon.jar copy...
TencentOS Server 3: tomcat (TSSA-2025:0592)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0592 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
CVE-2025-58407 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine...
EUVD-2020-6557
Malware in sbrugna...
EUVD-2020-7689
Malware in sbrugna...
EUVD-2021-20309
Malware in sbrugna...
EUVD-2016-1617
Malware in sbrugna...
EUVD-2016-1621
Malware in sbrugna...
RockyLinux 8 : kernel-rt (RLSA-2025:16373)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:16373 advisory. kernel: vsock: Fix transport TOCTOU CVE-2025-38461 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Note tha...
EUVD-2022-42353
Malicious code in bioql PyPI...