CVE-2024-23287

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data...

PT-2024-19727 · Apple · Macos Sonoma +1

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.4 Description: A privacy issue was addressed with improved handling of temporary files. This issue allows an app to potentially capture a user's screen. Recommendations: For macOS Sonoma versions prior to 14....

PT-2024-19780 · Apple · Macos Sonoma +4

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.4 iOS versions prior to 17.4 iPadOS versions prior to 17.4 watchOS versions prior to 10.4 Description: A privacy issue was addressed with improved handling of temporary files. This issue may allow an app to...

BIT-JENKINS-2021-21693

When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins LTS 2.303.2 and earlier...

BIT-GRADLE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

BIT-JENKINS-2023-43498

In Jenkins LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to rea...

openSUSE: Security Advisory for guava (SUSE-SU-2023:3090-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

PT-2024-12253 · Ibm · Ibm Security Access Manager Container

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager Container versions 10.0.0.0 through 10.0.6.1 Description: The issue is related to the temporary storage of sensitive information in files that could be accessed by a local user. Recommendations: For versions 10.0.0...

CVE-2024-1048

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not ...

grub2 security vulnerability

grub2 is a Linux system boot program from the American GNU community. A security vulnerability exists in grub2, which stems from the fact that if the program is terminated before a rename operation, temporary files will not be deleted and may fill the filesystem on multiple invocations, resulting...

PT-2024-1698 · Grub2 +5 · Grub2 +5

Name of the Vulnerable Software and Affected Versions: grub2 affected versions not specified Description: A flaw in the grub2-set-bootflag utility of grub2 can lead to a denial of service. The issue arises when the program creates a temporary file with new grubenv content and is killed before...

CVE-2024-1048

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not ...

Denial Of Service (DoS)

Bref is vulnerable to Denial Of Service DoS. The vulnerability is due to improper clean up of temporary files after processing a MultiPart requests when the Event-Driven Function runtime is utilized and the handler is a RequestHandlerInterface. This allows an attacker to fill the Lambda instance...

Bref's Uploaded Files Not Deleted in Event-Driven Functions

Impacted Resources bref/src/Event/Http/Psr7Bridge.php:94-125 Description When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each...

CVE-2024-24752

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each whic...

Design/Logic Flaw

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each whic...

CVE-2024-24752 Bref Uploaded Files Not Deleted in Event-Driven Functions

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each whic...

Bref Resource Management Error Vulnerability

Bref is an open source project by Matthieu Napoli Individual Developer that helps you go serverless on AWS using PHP. A resource management error vulnerability exists in versions prior to Bref 2.1.13 that stems from not deleting temporary files after processing a request...

PT-2024-20530 · Bref · Bref

Name of the Vulnerable Software and Affected Versions: Bref versions prior to 2.1.13 Description: The issue arises when Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During the...