Server side request forgery (ssrf)

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

CVE-2023-46725 FoodCoopShop Server-Side Request Forgery vulnerability

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

PT-2023-30172

Name of the Vulnerable Software and Affected Versions FoodCoopShop versions prior to 3.6.1 Description The issue is related to server-side request forgery. In the Network module, a manufacturer account can use the "/api/updateProducts.json" endpoint to make the server send a request to an arbitra...

CVE-2023-46725: Server-Side Request Forgery (SSRF)

FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the /api/updateProducts.json endpoint to make the server send a request to an...

Code injection

A Time of Check Time of Use TOCTOU vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files...

CVE-2022-3700

CVE-2022-3700 describes a TOCTOU race condition in Lenovo Vantage SystemUpdate Plugin (versions

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-003)

The version of tomcat installed on the remote host is prior to 9.0.58-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-003 advisory. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8...

Razer Synapse Race Condition / DLL Hijacking

Advisory ID: SYSS-2023-002 Product: Razer Synapse Manufacturer: Razer Inc. Affected Versions: Versions before 3.8.0428.042117 20230601 Tested Versions: 3.8.0228.022313 20230315 under Windows 10 Pro 10.0.19044 under Windows 11 Home 10.0.22621 Vulnerability Type: Improper Privilege Management CWE-2...

CVE-2023-28075

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the...

Design/Logic Flaw

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the...

CVE-2023-28075

Dell BIOS TOCTOU vulnerability (CVE-2023-28075) allows a locally authenticated user with physical access to trigger a specifically timed DMA operation during an SMI to gain arbitrary code execution. Affected component is the Dell BIOS; root cause is a Time‑of‑check Time‑of‑use flaw enabling TOCTO...

CVE-2023-4008 Incorrect Ownership Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known...

topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...

GHSA-F2WX-XJFW-XJV6 topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...

CVE-2023-32554

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2023-32555

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2023-32555

CVE-2023-32555 concerns Trend Micro Apex One and Apex One as a Service agent. It describes a Time-of-Check Time-Of-Use vulnerability that could allow a local attacker to escalate privileges on affected installations, requiring the attacker to first run low-privileged code. The provided documents ...

CVE-2023-32554

Technical details for CVE-2023-32554 are not publicly available in the provided documents. No confirmed affected products, versions, or fixes are disclosed here. Monitor for updates from official advisories to obtain concrete impact, remediation, and exploitation information.

CVE-2023-32554

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in...

CVE-2023-32554

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in...