disclosures

安全披露 这是记录我所遇到的安全问题的仓库。 Citrix Linux 客户端向 syslog 泄露凭据 Citrix Linux 客户端不安全的临时 ICA 文件创建 CVE-2023-24486...

CVE-2026-30332

CVE-2026-30332 描述 在 Balena Etcher for Windows 2.1.4 之前的版本中发现了一个时间检查到时间使用（TOCTOU）漏洞。 该应用程序会在用户可写目录中创建一个临时 .cmd 文件，随后通过 UAC 以提升权限执行该文件。 这允许在当前用户上下文中以中等完整性 运行的应用程序或进程，通过在临时脚本执行前注入恶意命令，将权限提升至高完整性 。 技术分析 当用户启动烧录过程时，Etcher 会执行以下步骤： 1. 在用户可写的临时目录中创建一个临时 .cmd 文件： C:\Users\AppData\Local\Temp\etcher\ 2...

CVE-2025-5880

Whistle 2.9.98 contiene una vulnerabilidad de path traversal sin parchear porque el endpoint /cgi-bin/sessions/get-temp-file no sanitiza adecuadamente la entrada del usuario en el parámetro filename. Al proporcionar rutas absolutas o secuencias de traversal como /etc/passwd, un atacante puede...

CVE-2025-25599

CVE-2025-25599 详细信息 Bolt 是一个基于 Symfony PHP 框架 构建的开源内容管理系统。在一次简短的安全评估中，Certitude 发现了多个漏洞，其中包括一个 任意文件读取 漏洞。 拥有 EDITOR 、CHIEFEDITOR 、ADMIN 或 DEVELOPER 角色的用户可能会滥用 不安全的临时文件泄露 功能（通过 URL上传头像 ），从而 读取底层服务器上的任意文件 。 更多详情，请参阅这篇 博客文章。 概念验证 Docker 提供了一个 Docker 容器用于测试。它在 Debian 基础镜像上通过 composer 安装并运行 Bolt CMS...

CVE-2026-89321

Eclipse OpenVSX is vulnerable to a disk exhaustion issue in its WebResourceService . When a VSIX is first requested via the unpkg endpoint, the service opens a zip entry with ZipFile.getInputStream() and passes the decompressed stream to Files.copy() without counting bytes written. The resulting ...

CVE-2014-5284

CVE-2014-5284 CVE-2014-5284 的 Bash 实现 漏洞标题：ossec 2.8 不安全临时文件创建漏洞权限提升 Python 很不错，但并非总是有效 漏洞作者：mbadanoiu Python 漏洞作者：skynet-13 厂商主页：www.ossec.net/ 软件链接：https://github.com/ossec/ossec-hids/archive/2.8.1.tar.gz 版本：OSSEC - 2.8 基于以下研究人员的工作创建 Jeff Petersen Roka Security LLC [email protected] 原始信息位于...

CVE-2026-25645

CVE-2026-25645 Reutilización insegura de archivos temporales en requests.utils.extractzippedpaths Resumen ejecutivo Se identificó una vulnerabilidad en la biblioteca requests Python dentro de la función de utilidad pública requests.utils.extractzippedpaths. La función utiliza un nombre de archivo...

Unity Linux 20.1070a Security Update: gzip (UTSA-2026-107043)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107043 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

gzip security update

1.9-15 - Fix the wrong date in the previous changelog message - There's an updated version of the CVE-2026-41992 fix Resolves: CVE-2026-41992 1.9-14 - Fix an issue with a temporary file creations when mktemp is missing 41991 - Fix a global buffer overflow vulnerability in the LZH decompression...

EUVD-2026-72488

A flaw was found in GLib2. When gfilereplace is used with GFILECREATEREPLACEDESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the...

CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

Oracle Linux 10 : ELSA-2026-61625-0: / gzip (ELSA-2026-616250)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-616250 advisory. 1.13-4 - Fix an issue with a temporary file creations when mktemp is missing 41991 - Fix a global buffer overflow vulnerability in the LZH...

CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59292

CVE-2026-59292 affects Spring Integration , where the default file-based PropertiesPersistingMetadataStore persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions , allowing local users with high privileges to read metadata. The CVSS 3....

CVE-2026-81572

In CodeMeter Runtime from version 8.40 to excluding 8.41a and 9.00 to excluding 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before fi...

CVE-2026-81572 Local Privilege Escalation in CodeMeter Runtime on Windows

cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary...

EUVD-2026-66979

cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary...

PT-2026-82475

Name of the Vulnerable Software and Affected Versions CodeMeter Runtime affected versions not specified Description The cmu.exe utility creates a predictable temporary file in the C:CM-Stick directory when the --create-io flag is used with the --file parameter. The application fails to properly...

CVE-2026-63404

Faktory is a language-agnostic background job server. In versions prior to 1.10.0 , its embedded Redis bootstrapper writes startup configuration to the fixed, world-writable path /tmp/redis.conf , creating the file only if absent and never validating it on subsequent boots. A local unprivileged u...

CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a...