instack-undercloud: uses hardcoded /tmp paths

A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files...

Design/Logic Flaw

Multiple temporary file creation vulnerabilities in pki-core 10.2.0...

CVE-2015-0234

Multiple temporary file creation vulnerabilities in pki-core 10.2.0...

CVE-2015-0234

CVE-2015-0234 affects pki-core 10.2.0 with multiple temporary file creation vulnerabilities. Connected sources confirm the issue is a vulnerability in pki-core 10.2.0 and cite an input-validation weakness as a contributing factor (CNVD-2017-33801). NVD records show CVSS scores: CVSSv2 base 5.0 (M...

UBUNTU-CVE-2015-0233

Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38...

CVE-2014-9513

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

CVE-2014-9513

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

Code injection

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

UBUNTU-CVE-2014-9513

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

CVE-2014-9513

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

CVE-2014-9513

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

CVE-2014-9513

CVE-2014-9513 concerns insecure use of temporary files in xbindkeys-config 0.1.3-2, enabling remote code execution. The primary affected component is xbindkeys-config (version 0.1.3-2). The description across connected sources consistently states that insecure handling of temporary files allows r...

CVE-2014-9513: Improper Access Control

Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code...

PT-2017-6359

Name of the Vulnerable Software and Affected Versions xbindkeys-config version 0.1.3-2 Description The issue is related to the insecure use of temporary files, which allows remote attackers to execute arbitrary code. Recommendations For version 0.1.3-2, at the moment, there is no information abou...

DEBIAN-CVE-2016-0764

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

UBUNTU-CVE-2016-0764

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

CVE-2016-0764

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

Race condition

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

CVE-2016-0764

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

CVE-2017-7501

It was found that rpm uses temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which coul...