CVE-2022-41954

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of "File.createTempFile.." results in temporary files being created with the permissions "-rw-r--r--". This means that any...

CVE-2022-41954: Exposure of Sensitive Information to an Unauthorized Actor

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other...

CVE-2022-41954

CVE-2022-41954 affects MPXJ prior to 10.14.1 on Unix-like systems, where using File.createTempFile(..) creates temporary files with -rw-r--r-- permissions, allowing other local users to read in-use schedule data. The vulnerability is patched in MPXJ 10.14.1 and later. A workaround is to set java....

CVE-2022-41954 Temporary File Information Disclosure Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other...

CVE-2022-41946

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

DEBIAN-CVE-2022-41946

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

Information disclosure

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

CVE-2022-41946

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

UBUNTU-CVE-2022-41946

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

PT-2022-5790

Name of the Vulnerable Software and Affected Versions pgjdbc versions prior to 4.5.0 Description The issue is related to the implementation of the PreparedStatement.setText or PreparedStatement.setBytea methods in the PgJDBC driver, which can lead to the creation of temporary files that are...

CVE-2022-41946 TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

SUSE SLES12: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (SUSE-SU-2022:4022-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4022-1 advisory. - CVE-2020-1945: Fixed insecure temporary file vulnerability bsc1171696. - CVE-2020-11979: Fixed issue introduced with fix for...

OpenKM 安全漏洞

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, file history and file sharing. A security vulnerability exists in OpenKM versions prior to 6.3.11, which originates from an unknown function getFileExtension in the...

CVE-2022-3969 OpenKM FileUtils.java getFileExtension temp file

A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this...

FreeBSD : ipython -- Execution with Unnecessary Privileges (35d1e192-628e-11ed-8c5e-641c67a117d8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 35d1e192-628e-11ed-8c5e-641c67a117d8 advisory. - IPython Interactive Python is a command shell for interactive computing in multiple programming...

ManyDesigns Portofino 安全漏洞

ManyDesigns Portofino is a low-code tool from ManyDesigns Italy. It is used to build model-driven REST APIs and web applications. A security vulnerability exists in ManyDesigns Portofino 5.3.2, which originates in an unknown section of the WarFileLauncher.java file, and can be exploited by an...

PT-2022-25934 · Hitachi · Hitachi Ops Center Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Infrastructure Analytics Advisor versions 2.0.0-00 through 4.4.0-00 Hitachi Ops Center Analyzer versions 10.0.0-00 through 10.8.0-00 Description: The issue allows local users to gain sensitive information due to the insertion of...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

Ubuntu: Security Advisory (USN-61-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...