2576 matches found
CVE-2021-26910
Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...
PT-2021-3612 · Firejail +4 · Firejail +4
Name of the Vulnerable Software and Affected Versions: Firejail versions prior to 0.9.64.4 Description: The issue is related to insufficient checking of the state of a shared resource in the OverlayFS SUID sandbox component of Firejail. This can allow an attacker to access confidential data,...
CVE-2020-14418
A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...
Path traversal
A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...
CVE-2020-14418
A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...
CVE-2020-14418
CVE-2020-14418 refers to a TOCTOU vulnerability in the library/middleware product madCodeHook before 2020-07-16, enabling local attackers to escalate to SYSTEM via path redirection (directory junctions). The issue is a local privilege escalation with an impact on confidentiality, integrity, and a...
Jenkins < 2.263.3 LTS / 2.276 TOCTOU
The version of Jenkins running on the remote web server is prior to 2.276 weekly or 2.263.3 LTS. It is, therefore, affected by a time-of-check to time-of-use TOCTOU race condition that allows reading arbitrary files using the file browser for workspaces and archived artifacts. Note that Nessus ha...
Jenkins < 2.276, < 2.263.3 Arbitrary File Read Vulnerability
Jenkins is prone to an arbitrary file read vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...
CVE-2021-21615
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...
CloudBees Jenkins TOCTOU Competitive Conditions Vulnerability
Jenkins is an open source continuous integration tool written in Java , mainly used for continuous , automated build/test software projects , monitor the operation of external tasks . A TOCTOU competitive condition vulnerability exists in Jenkins 2.275, LTS 2.263.2. An attacker can exploit this...
CVE-2021-21615
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...
Race condition
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2021-21615
The CVE-2021-21615 issue affects Jenkins 2.275 and LTS 2.263.2 and is caused by a TOCTOU race in the file browser used for workspaces and archived artifacts, enabling reading arbitrary files. Exploitation requires privileges such as Job/Workspace permission or control of workspace contents (e.g.,...
CVE-2021-21615
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2021-21615
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...
Cloudbees Jenkins 安全漏洞
Jenkins is an open source continuous integration tool written in Java , mainly used for continuous , automated build/test software projects , monitor the operation of external tasks . A TOCTOU competitive condition vulnerability exists in Jenkins 2.275, LTS 2.263.2. An attacker can exploit this...
PT-2021-14658 · Jenkins · Jenkins
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.275 through 2.275 Jenkins LTS versions 2.263.2 through 2.263.2 Description: The issue is caused by a time-of-check to time-of-use TOCTOU race condition, allowing attackers to read arbitrary files using the file browser for...
Windows Exploitation Tricks: Trapping Virtual Memory Access
Posted by James Forshaw, Project Zero This blog is a continuation of my series of Windows exploitation tricks. This one describes an exploitation trick I’ve been trying to develop for years, succeeding mostly, more on that later on the latest versions of Windows 10. It’s a trick to trap access to...
